Context Navigation

← Previous Period
Next Period →

Timeline

Mar 6, 2016:

11:54 PM Changeset in webkit [197660] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.4/Source/JavaScriptCore

Merge r173886 - [CLoop] - Fix CLoop on the 32-bit Big-Endians
https://bugs.webkit.org/show_bug.cgi?id=137020

Patch by Tomas Popela <tpopela@redhat.com> on 2014-09-23
Reviewed by Mark Lam.

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:

10:41 PM Changeset in webkit [197659] by Nikita Vasilyev

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Use half-pixel borders for data grids
https://bugs.webkit.org/show_bug.cgi?id=154437
<rdar://problem/24736365>

Reviewed by Timothy Hatcher.

UserInterface/Views/DataGrid.css:

(.data-grid.inline):
(.data-grid th):
(.data-grid :matches(th, td):not(:last-child)):
Half-pixel borders round to 1px on 1x (non-retina) screens since r192444.

UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid.prototype._positionResizerElements):
Use getBoundingClientRect for better precision since it provides subpixel values.

7:52 PM Changeset in webkit [197658] by BJ Burg

12 edits in trunk/Source/JavaScriptCore

Web Inspector: the protocol generator should have separate prefix options for Objective-C classes and filenames
https://bugs.webkit.org/show_bug.cgi?id=155101
<rdar://problem/25000053>

Reviewed by Timothy Hatcher.

It should be possible to generate Objective-C protocol types without prefixing all class names.
The prefixes are only necessary when the generated files are part of a framework, but this isn't
how the generated Objective-C frontend files are used.

Add a separate framework setting and switch over code to use the 'protocol_group' in filenames,
and the 'objc_prefix' for Objective-C enum and class prefixes.

No tests need to be rebaselined because tests always set the protocol_group and objc_prefix
to the same value.

inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:

(ObjCBackendDispatcherHeaderGenerator.output_filename):

inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:

(ObjCConfigurationImplementationGenerator.output_filename):
(ObjCConfigurationImplementationGenerator.generate_output):

inspector/scripts/codegen/generate_objc_configuration_header.py:

(ObjCConfigurationHeaderGenerator.output_filename):
(ObjCConfigurationHeaderGenerator.generate_output):
(ObjCConfigurationHeaderGenerator._generate_configuration_interface_for_domains):

inspector/scripts/codegen/generate_objc_configuration_implementation.py:

(ObjCBackendDispatcherImplementationGenerator.output_filename):
(ObjCBackendDispatcherImplementationGenerator.generate_output):
(ObjCBackendDispatcherImplementationGenerator._generate_configuration_implementation_for_domains):

inspector/scripts/codegen/generate_objc_conversion_helpers.py:

(ObjCConversionHelpersGenerator.output_filename):

inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:

(ObjCFrontendDispatcherImplementationGenerator.output_filename):
(ObjCFrontendDispatcherImplementationGenerator.generate_output):

inspector/scripts/codegen/generate_objc_header.py:

(ObjCHeaderGenerator.output_filename):

inspector/scripts/codegen/generate_objc_internal_header.py:

(ObjCInternalHeaderGenerator.output_filename):
(ObjCInternalHeaderGenerator.generate_output):

inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:

(ObjCProtocolTypesImplementationGenerator.output_filename):
(ObjCProtocolTypesImplementationGenerator.generate_output):

inspector/scripts/codegen/models.py:
inspector/scripts/codegen/objc_generator.py:

(ObjCGenerator):
(ObjCGenerator.protocol_name):
(ObjCGenerator.objc_prefix):

7:37 PM Changeset in webkit [197657] by BJ Burg

6 edits in trunk/Source/JavaScriptCore

Unreviewed, rebaseline inspector protocol generator tests after r197563.

inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
inspector/scripts/tests/expected/enum-values.json-result:
inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:

7:36 PM Changeset in webkit [197656] by enrica@apple.com

3 edits in trunk/Source/WebKit2

Support preview on attachment elements.
https://bugs.webkit.org/show_bug.cgi?id=155074
rdar://problem/24806079

Reviewed by Sam Weinig.

Allowing preview to start on attachment elements.
Adding a private UIDelegate method to provide the data for the preview.

UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _interactionShouldBeginFromPreviewItemController:forPosition:]):
(-[WKContentView _dataForPreviewItemController:atPosition:type:]):

7:21 PM Changeset in webkit [197655] by benjamin@webkit.org

3 edits in trunk/Source/JavaScriptCore

[JSC] Improve DFG's Int32 ArithMul if one operand is a constant
https://bugs.webkit.org/show_bug.cgi?id=155066

Reviewed by Filip Pizlo.

When multiplying an integer by a constant, DFG was doing quite
a bit worse than baseline JIT.
We were loading the constant into a register, doing the multiply,
the checking the result and both operands for negative zero.

This patch changes:
-Use the multiply-by-immediate form on x86.
-Do as few checks as possible to detect negative-zero.

In most cases, this reduce the negative-zero checks
to zero or one TEST+JUMP.

assembler/MacroAssembler.h:

(JSC::MacroAssembler::mul32):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithMul):

6:43 PM Changeset in webkit [197654] by benjamin@webkit.org

4 edits in trunk/Source/JavaScriptCore

[JSC] Remove a superfluous Move in front of every double unboxing
https://bugs.webkit.org/show_bug.cgi?id=155064

Reviewed by Saam Barati.

Double unboxing was always doing:

Move source, scratch
Add64 tag, scratch
IntToDouble scratch, fp

We do not need to "Move" to copy the source.
Both x86 and ARM64 have an efficient 3 operands Add instruction.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileDoubleRep):
(JSC::DFG::SpeculativeJIT::speculateRealNumber):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::unboxDouble):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::unboxDoubleWithoutAssertions):
(JSC::AssemblyHelpers::unboxDouble):
(JSC::AssemblyHelpers::unboxDoubleNonDestructive):

6:42 PM Changeset in webkit [197653] by benjamin@webkit.org

6 edits in trunk/Source/JavaScriptCore

[JSC] Use 3 operands Add in more places
https://bugs.webkit.org/show_bug.cgi?id=155082

Reviewed by Filip Pizlo.

assembler/MacroAssembler.h:

(JSC::MacroAssembler::addPtr):
(JSC::MacroAssembler::add32):

assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::add32):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithAdd):
The case with child1 constant is useless.
The canonical form will have the constant as child2.

Also add register reuse for the fast-add.
Registers are a scarce resource on x86.

jit/CCallHelpers.h:

(JSC::CCallHelpers::prepareForTailCallSlow):

yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generate):

6:40 PM Changeset in webkit [197652] by commit-queue@webkit.org

14 edits in trunk/Source

[JSC] Improve codegen of Compare and Test
https://bugs.webkit.org/show_bug.cgi?id=155055

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-03-06
Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch introduces a few improvements on how we lower
Compare and Test with immediates:

-Add certain Immediate forms of ARM64.
-Use CBZ/CBNZ when possible on ARM64.
-When possible, convert a CMP into a TST

On some hardware, we can issue more TST simultaneously.

On x86, any TST+Jump is candidate for macro-fusion.
They are also smaller.
(sections 3.4.2.2 and 3.5.1.9)

-Do not load the mask immediate of a TST

if it only contains ones (mostly useful for ARM64
since that would not have been a valid immediate).

assembler/MacroAssembler.h:

(JSC::MacroAssembler::compare32):

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
This is somewhat unrelated but I found that out while working
on moveDoubleConditionallyTest32:

If "thenCase" and "dest" are assigned the same register
by the allocator, then the first (f)fcsel would override
the "thenCase" and the second fcsel would always be "elseCase".

This is covered by testb3 but was only uncovered
after recent "Move" removals in lowering.

(JSC::MacroAssemblerARM64::moveConditionally32):
(JSC::MacroAssemblerARM64::moveConditionally64):
(JSC::MacroAssemblerARM64::moveConditionallyTest32):
(JSC::MacroAssemblerARM64::moveDoubleConditionally32):
(JSC::MacroAssemblerARM64::moveDoubleConditionally64):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyTest32):
(JSC::MacroAssemblerARM64::branch32):
(JSC::MacroAssemblerARM64::branch64):
(JSC::MacroAssemblerARM64::branchTest32):
(JSC::MacroAssemblerARM64::test32):
The version taking an immediate was guarded by

(cond == Zero)

(cond == NonZero). That is overzealous,

and only needed for CBZ/CBNZ.

(JSC::MacroAssemblerARM64::branchTest64):
(JSC::MacroAssemblerARM64::compare32):
(JSC::MacroAssemblerARM64::compare64):
(JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::moveConditionally32):
(JSC::MacroAssemblerX86Common::moveConditionallyTest32):
(JSC::MacroAssemblerX86Common::branch32):
(JSC::MacroAssemblerX86Common::test32):
(JSC::MacroAssemblerX86Common::branchTest32):
(JSC::MacroAssemblerX86Common::compare32):
(JSC::MacroAssemblerX86Common::commuteCompareToZeroIntoTest):

assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::compare64):
(JSC::MacroAssemblerX86_64::branch64):
(JSC::MacroAssemblerX86_64::moveConditionally64):

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::createGenericCompare):
Unfortunately this cannot be abstracted by the MacroAssembler.
Those immediates are not valid, we have to pick the better
for right away.

b3/air/AirOpcode.opcodes:
b3/testb3.cpp:

(JSC::B3::int64Operands):
(JSC::B3::modelCompare):
(JSC::B3::testCompareImpl):
(JSC::B3::testCompare):
(JSC::B3::b3Pow):
(JSC::B3::testPowDoubleByIntegerLoop):
Some versions of pow(double, int) do not return
the exact same bits as our integer loop.
Added a new version to have the same behavior
as the B3 loop.

(JSC::B3::run):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileInt32Compare):
Comparing to an immediate is super common. Do not waste
a register for that!

Source/WebCore:

cssjit/FunctionCall.h:

(WebCore::FunctionCall::callAndBranchOnCondition):

6:40 PM Changeset in webkit [197651] by jonlee@apple.com

2 edits in trunk/PerformanceTests

Make sure multiply test particles have at least some opacity
https://bugs.webkit.org/show_bug.cgi?id=155027

Reviewed by Simon Fraser.

Animometer/tests/master/resources/multiply.js:

(initialize): Have the elements spin a little faster to make it
more obvious when the system is being stressed.
(_addTile):
(animate): Make sure each element being animated has at least 1%
opacity.

6:22 PM Changeset in webkit [197650] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix build. This was a messed up merge.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):

6:07 PM Changeset in webkit [197649] by fpizlo@apple.com

15 edits in trunk/Source/JavaScriptCore

DFG should know how to speculate StringOrOther
https://bugs.webkit.org/show_bug.cgi?id=155094

Reviewed by Saam Barati.

Any code that processes the regexp matches array was previously doing a relatively expensive
Branch(Untyped:). This introduces a new use kind called StringOrOther, which is perfect for
code that loops over the matches array and branches on the entries being non-empty.

To do this, I needed to introduce code into the FTL that creates new blocks. We still had that
awful FTL_NEW_BLOCK idiom since the only way to debug LLVM IR was to ascribe names to basic
blocks. B3 IR is inherently more debuggable since unlike LLVM, B3 knows how to always respect
code origin, and it knows how to print the code origin nicely in the dumps. So, rather than
continue using FTL_NEW_BLOCK(m_out, ("things")), I replaced all of that stuff with
m_out.newBlock(). It's much nicer that way.

This is a tiny speed-up on Octane/regexp at best. I was hoping for more. Oh well.

bytecode/SpeculatedType.h:

(JSC::isStringSpeculation):
(JSC::isStringOrOtherSpeculation):
(JSC::isSymbolSpeculation):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateString):
(JSC::DFG::Node::shouldSpeculateStringOrOther):
(JSC::DFG::Node::shouldSpeculateStringObject):

dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileStringZeroLength):
(JSC::DFG::SpeculativeJIT::compileLogicalNotStringOrOther):
(JSC::DFG::SpeculativeJIT::emitStringBranch):
(JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch):
(JSC::DFG::SpeculativeJIT::compileConstantStoragePointer):
(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
(JSC::DFG::SpeculativeJIT::speculateString):
(JSC::DFG::SpeculativeJIT::speculateStringOrOther):
(JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
(JSC::DFG::SpeculativeJIT::speculate):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):

dfg/DFGUseKind.cpp:

(WTF::printInternal):

dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):
(JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
(JSC::FTL::DFG::LowerDFGToB3::compileBooleanToNumber):
(JSC::FTL::DFG::LowerDFGToB3::compileToThis):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
(JSC::FTL::DFG::LowerDFGToB3::compileArithDiv):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMod):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMinOrMax):
(JSC::FTL::DFG::LowerDFGToB3::compileArithPow):
(JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckStructure):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure):
(JSC::FTL::DFG::LowerDFGToB3::compileGetById):
(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileCopyRest):
(JSC::FTL::DFG::LowerDFGToB3::compileGetRestLength):
(JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor):
(JSC::FTL::DFG::LowerDFGToB3::compileToPrimitive):
(JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringFromCharCode):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
(JSC::FTL::DFG::LowerDFGToB3::compileSwitch):
(JSC::FTL::DFG::LowerDFGToB3::compileIsString):
(JSC::FTL::DFG::LowerDFGToB3::compileIsObject):
(JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
(JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
(JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
(JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
(JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
(JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty):
(JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
(JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorStructurePname):
(JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorGenericPname):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
(JSC::FTL::DFG::LowerDFGToB3::checkStructure):
(JSC::FTL::DFG::LowerDFGToB3::numberOrNotCellToInt32):
(JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
(JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
(JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier):
(JSC::FTL::DFG::LowerDFGToB3::copyBarrier):
(JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly):
(JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
(JSC::FTL::DFG::LowerDFGToB3::nonSpeculativeCompare):
(JSC::FTL::DFG::LowerDFGToB3::stringsEqual):
(JSC::FTL::DFG::LowerDFGToB3::allocateCell):
(JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
(JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd):
(JSC::FTL::DFG::LowerDFGToB3::allocateObject):
(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
(JSC::FTL::DFG::LowerDFGToB3::boolify):
(JSC::FTL::DFG::LowerDFGToB3::equalNullOrUndefined):
(JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
(JSC::FTL::DFG::LowerDFGToB3::switchString):
(JSC::FTL::DFG::LowerDFGToB3::switchStringRecurse):
(JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
(JSC::FTL::DFG::LowerDFGToB3::doubleToInt32):
(JSC::FTL::DFG::LowerDFGToB3::sensibleDoubleToInt32):
(JSC::FTL::DFG::LowerDFGToB3::strictInt52ToJSValue):
(JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
(JSC::FTL::DFG::LowerDFGToB3::convertDoubleToInt32):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
(JSC::FTL::DFG::LowerDFGToB3::speculateObjectOrOther):
(JSC::FTL::DFG::LowerDFGToB3::speculateString):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringIdent):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringOrStringObject):
(JSC::FTL::DFG::LowerDFGToB3::speculateRealNumber):
(JSC::FTL::DFG::LowerDFGToB3::speculateNotStringVar):
(JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
(JSC::FTL::DFG::LowerDFGToB3::callCheck):

ftl/FTLOutput.cpp:

(JSC::FTL::Output::initialize):
(JSC::FTL::Output::newBlock):
(JSC::FTL::Output::check):

ftl/FTLOutput.h:

(JSC::FTL::Output::setFrequency):
(JSC::FTL::Output::insertNewBlocksBefore):

5:00 PM Changeset in webkit [197648] by sbarati@apple.com

90 edits in trunk/Source

GetPrototypeOf should be a fully virtual method in the method table
https://bugs.webkit.org/show_bug.cgi?id=155002

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch makes us more consistent with how the ES6 specification models the
GetPrototypeOf trap. Moving this method into ClassInfo::methodTable
is a prerequisite for implementing Proxy.GetPrototypeOf. This patch
still allows directly accessing the prototype for situations where this
is the desired behavior. This is equivalent to getting the internal
Prototype field as described in the specification.

API/JSObjectRef.cpp:

(JSObjectGetPrototype):
(JSObjectSetPrototype):

dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
(JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):

jit/JITOperations.cpp:
jit/JITOperations.h:
jsc.cpp:

(functionCreateProxy):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/ArrayPrototype.cpp:

(JSC::speciesConstructArray):

runtime/ClassInfo.h:
runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncBind):

runtime/IntlCollatorPrototype.cpp:

(JSC::IntlCollatorPrototypeGetterCompare):

runtime/IntlDateTimeFormatPrototype.cpp:

(JSC::IntlDateTimeFormatPrototypeGetterFormat):

runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatPrototypeGetterFormat):

runtime/JSBoundFunction.cpp:

(JSC::hasInstanceBoundFunction):
(JSC::getBoundFunctionStructure):
(JSC::JSBoundFunction::create):

runtime/JSBoundFunction.h:
runtime/JSCJSValue.cpp:

(JSC::JSValue::putToPrimitive):

runtime/JSCell.cpp:

(JSC::JSCell::setPrototype):
(JSC::JSCell::getPrototype):

runtime/JSCell.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::hasLegacyProfiler):
(JSC::lastInPrototypeChain):
(JSC::JSGlobalObject::objectPrototypeIsSane):
(JSC::JSGlobalObject::arrayPrototypeChainIsSane):
(JSC::JSGlobalObject::stringPrototypeChainIsSane):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::finishCreation):

runtime/JSGlobalObjectFunctions.cpp:

(JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
(JSC::GlobalFuncProtoGetterFunctor::operator()):
(JSC::globalFuncProtoGetter):

runtime/JSLexicalEnvironment.cpp:

(JSC::JSLexicalEnvironment::getOwnPropertySlot):

runtime/JSObject.cpp:

(JSC::JSObject::calculatedClassName):
(JSC::JSObject::putInlineSlow):
(JSC::JSObject::setPrototypeWithCycleCheck):
(JSC::JSObject::setPrototype):
(JSC::JSObject::getPrototype):
(JSC::JSObject::defaultHasInstance):
(JSC::objectPrivateFuncInstanceOf):
(JSC::JSObject::getPropertyNames):
(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
(JSC::JSObject::attemptToInterceptPutByIndexOnHole):
(JSC::JSObject::getGenericPropertyNames):

runtime/JSObject.h:

(JSC::JSObject::finishCreation):
(JSC::JSObject::JSObject):
(JSC::JSObject::getPrototypeDirect):
(JSC::JSObject::getPrototype):
(JSC::JSObject::getOwnNonIndexPropertySlot):
(JSC::JSObject::getPropertySlot):
(JSC::JSObject::getNonIndexPropertySlot):
(JSC::JSObject::prototype): Deleted.

runtime/JSObjectInlines.h:

(JSC::JSObject::canPerformFastPutInline):

runtime/JSProxy.cpp:

(JSC::JSProxy::setTarget):

runtime/JSTypedArrayViewConstructor.cpp:

(JSC::constructTypedArrayView):

runtime/ObjectConstructor.cpp:

(JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
(JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
(JSC::objectConstructorGetPrototypeOf):

runtime/ObjectPrototype.cpp:

(JSC::objectProtoFuncIsPrototypeOf):

runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performSetPrototype):

runtime/StructureInlines.h:

(JSC::Structure::isValid):

tests/stress/proxy-has-property.js:

(assert.let.h1.has):
(assert.let.h2.has):
(assert):

Source/WebCore:

Change ::getPrototype(.) to ::prototype(.) in various places to prevent
a naming conflict with JSC.

No new tests because no new functionality was added.

bindings/js/JSDOMWindowShell.cpp:

(WebCore::JSDOMWindowShell::setWindow):

bindings/js/JSImageConstructor.cpp:

(WebCore::JSImageConstructor::initializeProperties):
(WebCore::JSImageConstructor::prototypeForStructure):

bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::initScript):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorHelperMethods):

bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:

(WebCore::JSTestActiveDOMObjectConstructor::initializeProperties):
(WebCore::JSTestActiveDOMObject::createPrototype):
(WebCore::JSTestActiveDOMObject::prototype):
(WebCore::JSTestActiveDOMObject::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestActiveDOMObject.h:
bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:

(WebCore::JSTestClassWithJSBuiltinConstructorConstructor::initializeProperties):
(WebCore::JSTestClassWithJSBuiltinConstructor::createPrototype):
(WebCore::JSTestClassWithJSBuiltinConstructor::prototype):
(WebCore::JSTestClassWithJSBuiltinConstructor::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:

(WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::initializeProperties):
(WebCore::JSTestCustomConstructorWithNoInterfaceObject::createPrototype):
(WebCore::JSTestCustomConstructorWithNoInterfaceObject::prototype):
(WebCore::JSTestCustomConstructorWithNoInterfaceObject::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:

(WebCore::JSTestCustomNamedGetterConstructor::initializeProperties):
(WebCore::JSTestCustomNamedGetter::createPrototype):
(WebCore::JSTestCustomNamedGetter::prototype):
(WebCore::JSTestCustomNamedGetter::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
bindings/scripts/test/JS/JSTestEventConstructor.cpp:

(WebCore::JSTestEventConstructorConstructor::initializeProperties):
(WebCore::JSTestEventConstructor::createPrototype):
(WebCore::JSTestEventConstructor::prototype):
(WebCore::JSTestEventConstructor::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestEventConstructor.h:
bindings/scripts/test/JS/JSTestEventTarget.cpp:

(WebCore::JSTestEventTargetConstructor::initializeProperties):
(WebCore::JSTestEventTarget::createPrototype):
(WebCore::JSTestEventTarget::prototype):
(WebCore::JSTestEventTarget::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestEventTarget.h:
bindings/scripts/test/JS/JSTestException.cpp:

(WebCore::JSTestExceptionConstructor::initializeProperties):
(WebCore::JSTestException::createPrototype):
(WebCore::JSTestException::prototype):
(WebCore::JSTestException::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestException.h:
bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:

(WebCore::JSTestGenerateIsReachableConstructor::initializeProperties):
(WebCore::JSTestGenerateIsReachable::createPrototype):
(WebCore::JSTestGenerateIsReachable::prototype):
(WebCore::JSTestGenerateIsReachable::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
bindings/scripts/test/JS/JSTestInterface.cpp:

(WebCore::JSTestInterfaceConstructor::initializeProperties):
(WebCore::JSTestInterface::createPrototype):
(WebCore::JSTestInterface::prototype):
(WebCore::JSTestInterface::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestInterface.h:
bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:

(WebCore::JSTestJSBuiltinConstructorConstructor::initializeProperties):
(WebCore::JSTestJSBuiltinConstructor::createPrototype):
(WebCore::JSTestJSBuiltinConstructor::prototype):
(WebCore::JSTestJSBuiltinConstructor::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:

(WebCore::JSTestMediaQueryListListenerConstructor::initializeProperties):
(WebCore::JSTestMediaQueryListListener::createPrototype):
(WebCore::JSTestMediaQueryListListener::prototype):
(WebCore::JSTestMediaQueryListListener::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
bindings/scripts/test/JS/JSTestNamedConstructor.cpp:

(WebCore::JSTestNamedConstructorConstructor::initializeProperties):
(WebCore::JSTestNamedConstructorNamedConstructor::initializeProperties):
(WebCore::JSTestNamedConstructor::createPrototype):
(WebCore::JSTestNamedConstructor::prototype):
(WebCore::JSTestNamedConstructor::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestNamedConstructor.h:
bindings/scripts/test/JS/JSTestNode.cpp:

(WebCore::JSTestNodeConstructor::initializeProperties):
(WebCore::JSTestNode::createPrototype):
(WebCore::JSTestNode::prototype):
(WebCore::JSTestNode::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestNode.h:
bindings/scripts/test/JS/JSTestNondeterministic.cpp:

(WebCore::JSTestNondeterministicConstructor::initializeProperties):
(WebCore::JSTestNondeterministic::createPrototype):
(WebCore::JSTestNondeterministic::prototype):
(WebCore::JSTestNondeterministic::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestNondeterministic.h:
bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::JSTestObjConstructor::initializeProperties):
(WebCore::JSTestObj::createPrototype):
(WebCore::JSTestObj::prototype):
(WebCore::JSTestObj::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestObj.h:
bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

(WebCore::JSTestOverloadedConstructorsConstructor::initializeProperties):
(WebCore::JSTestOverloadedConstructors::createPrototype):
(WebCore::JSTestOverloadedConstructors::prototype):
(WebCore::JSTestOverloadedConstructors::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:

(WebCore::JSTestOverrideBuiltinsConstructor::initializeProperties):
(WebCore::JSTestOverrideBuiltins::createPrototype):
(WebCore::JSTestOverrideBuiltins::prototype):
(WebCore::JSTestOverrideBuiltins::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:

(WebCore::JSTestSerializedScriptValueInterfaceConstructor::initializeProperties):
(WebCore::JSTestSerializedScriptValueInterface::createPrototype):
(WebCore::JSTestSerializedScriptValueInterface::prototype):
(WebCore::JSTestSerializedScriptValueInterface::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::JSTestTypedefsConstructor::initializeProperties):
(WebCore::JSTestTypedefs::createPrototype):
(WebCore::JSTestTypedefs::prototype):
(WebCore::JSTestTypedefs::getPrototype): Deleted.

bindings/scripts/test/JS/JSTestTypedefs.h:
bindings/scripts/test/JS/JSattribute.cpp:

(WebCore::JSattributeConstructor::initializeProperties):
(WebCore::JSattribute::createPrototype):
(WebCore::JSattribute::prototype):
(WebCore::JSattribute::getPrototype): Deleted.

bindings/scripts/test/JS/JSattribute.h:
bindings/scripts/test/JS/JSreadonly.cpp:

(WebCore::JSreadonlyConstructor::initializeProperties):
(WebCore::JSreadonly::createPrototype):
(WebCore::JSreadonly::prototype):
(WebCore::JSreadonly::getPrototype): Deleted.

bindings/scripts/test/JS/JSreadonly.h:

3:40 PM Changeset in webkit [197647] by Alan Bujtas

2 edits in trunk/LayoutTests

[iOS] Some more gardening after r197627.

Unreviewed.

platform/ios-simulator/TestExpectations: skip a test.

3:12 PM Changeset in webkit [197646] by commit-queue@webkit.org

40 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r197645.
https://bugs.webkit.org/show_bug.cgi?id=155097

"Doesn't build properly when building entire webkit"
(Requested by saamyjoon on #webkit).

Reverted changeset:

"GetPrototypeOf should be a fully virtual method in the
method table"
https://bugs.webkit.org/show_bug.cgi?id=155002
http://trac.webkit.org/changeset/197645

3:05 PM Changeset in webkit [197645] by sbarati@apple.com

40 edits in trunk/Source/JavaScriptCore

GetPrototypeOf should be a fully virtual method in the method table
https://bugs.webkit.org/show_bug.cgi?id=155002

Reviewed by Filip Pizlo.

API/JSObjectRef.cpp:

(JSObjectGetPrototype):
(JSObjectSetPrototype):

dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
(JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):

jit/JITOperations.cpp:
jit/JITOperations.h:
jsc.cpp:

(functionCreateProxy):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/ArrayPrototype.cpp:

(JSC::speciesConstructArray):

runtime/ClassInfo.h:
runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncBind):

runtime/IntlCollatorPrototype.cpp:

(JSC::IntlCollatorPrototypeGetterCompare):

runtime/IntlDateTimeFormatPrototype.cpp:

(JSC::IntlDateTimeFormatPrototypeGetterFormat):

runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatPrototypeGetterFormat):

runtime/JSBoundFunction.cpp:

(JSC::hasInstanceBoundFunction):
(JSC::getBoundFunctionStructure):
(JSC::JSBoundFunction::create):

runtime/JSBoundFunction.h:
runtime/JSCJSValue.cpp:

(JSC::JSValue::putToPrimitive):

runtime/JSCell.cpp:

(JSC::JSCell::setPrototype):
(JSC::JSCell::getPrototype):

runtime/JSCell.h:
runtime/JSGlobalObject.cpp:

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::finishCreation):

runtime/JSGlobalObjectFunctions.cpp:

(JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
(JSC::GlobalFuncProtoGetterFunctor::operator()):
(JSC::globalFuncProtoGetter):

runtime/JSLexicalEnvironment.cpp:

(JSC::JSLexicalEnvironment::getOwnPropertySlot):

runtime/JSObject.cpp:

runtime/JSObject.h:

runtime/JSObjectInlines.h:

(JSC::JSObject::canPerformFastPutInline):

runtime/JSProxy.cpp:

(JSC::JSProxy::setTarget):

runtime/JSTypedArrayViewConstructor.cpp:

(JSC::constructTypedArrayView):

runtime/ObjectConstructor.cpp:

(JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
(JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
(JSC::objectConstructorGetPrototypeOf):

runtime/ObjectPrototype.cpp:

(JSC::objectProtoFuncIsPrototypeOf):

runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performSetPrototype):

runtime/StructureInlines.h:

(JSC::Structure::isValid):

tests/stress/proxy-has-property.js:

(assert.let.h1.has):
(assert.let.h2.has):
(assert):

2:57 PM Changeset in webkit [197644] by Alan Bujtas

2 edits in trunk/LayoutTests

[iOS] Gardening after r197627.

Unreviewed.

platform/ios-simulator/TestExpectations:

2:30 PM Changeset in webkit [197643] by sbarati@apple.com

2 edits in trunk/Websites/webkit.org

Update style guide to reflect our style of only using "override" or "final" when overriding virtual methods
https://bugs.webkit.org/show_bug.cgi?id=154978

Reviewed by Darin Adler.

code-style.md:

12:44 PM Changeset in webkit [197642] by youenn.fablet@crf.canon.fr

7 edits in trunk/Source/WebCore

Enable DOM class create functions to take parameters in case of JSBuiltinConstructor
https://bugs.webkit.org/show_bug.cgi?id=155022

Reviewed by Darin Adler.

Introducing JSDOMObjectInspector to check whether a given JS class is built-in (no DOM class).
If that is not the case, the JS class wraps a DOM class.
The inspector detects whether the DOM class create static method takes no parameter or some parameters.
This is used in JSDOMConstructor.h to generate correctly the createJSObject functions needed by JSBuiltinConstructor.

Updated binding generator to not generate anymore createJSObject as it is handled directly in JSDOMConstructor.h.

Covered by existing tests.

bindings/js/JSDOMConstructor.h:

(WebCore::JSBuiltinConstructor<JSClass>::callConstructor):
(WebCore::createJSObject):
(WebCore::JSBuiltinConstructor<JSClass>::construct):

bindings/js/JSDOMWrapper.h:
bindings/js/JSKeyValueIterator.h: Taking benefit of JSClass::DOMWrapper type declaration.
bindings/js/JSReadableStreamPrivateConstructors.cpp:

(WebCore::JSBuiltinReadableStreamReaderPrivateConstructor::initializeExecutable): Deleted.
(WebCore::JSBuiltinReadableStreamControllerPrivateConstructor::initializeExecutable): Deleted.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateConstructorDefinition): Deleted.

bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:

(WebCore::JSTestClassWithJSBuiltinConstructorConstructor::prototypeForStructure): Deleted.

12:11 PM Changeset in webkit [197641] by fpizlo@apple.com

33 edits
5 adds in trunk

RegExpMatchesArray doesn't know how to have a bad time
https://bugs.webkit.org/show_bug.cgi?id=155069

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

In trunk if we are having a bad time, the regexp matches array is still allocated with a
non-slow-put indexing shape, which makes it have the wrong behavior on indexed setters on
the prototype chain.

Getting this to work right requires introducing bad time code paths into the regexp matches
array. It also requires something more drastic: making this code not play games with the
global object. The code that creates the matches array needs to have the actual global
object of the regexp native function that it's logically created by.

This is totally different from how we've handled global objects in the past because it means
that the global object is not a constant. Normally we can make it a constant because a
script executable will know its global object. But with native functions, it's the function
instance that knows the global object - not the native executable. When we inline a native
intrinsic, we are guaranteed to know the native executable but we're not guaranteed to know
the functon instance. This means that the global object may be a variable that gets computed
by looking at the instance at run-time. So, the RegExpExec/RegExpTest nodes in DFG IR now
take a global object child. That also meant adding a new node type, GetGlobalObject, which
does the thing to the callee that CallFrame::lexicalGlobalObject() would have done.
Eventually, we'll probably have to make other native intrinsics also use GetGlobalObject. It
turns out that this really isn't so bad because usually it's constant-folded anyway, since
although the intrinsic code supports executable-based inlining (which leaves the callee
instance as an unknown), it happens rarely for intrinsics. So, conveying the global object
via a child isn't any worse than conveying it via meta-data, and it's probably better than
telling the inliner not to do executable-based inlining of native intrinsics. That would
have been a confusing special-case.

This is perf-neutral on my machines but it fixes a bug and it unlocks some interesting
possibilities. For example, RegExpExec can now make a firm promise about the type of array
it's creating.

This also contains some other changes:

We are now using Structure::addPropertyTransition() in a lot of places even though it was meant to be an internal method with a quirky contract - for example if only works if you know that there is not existing transition. This relaxes this constraint.

Restores the use of "*" for heap references in JSString.h. It's very unusual to have heap references pointed at with "&", since we don't currently do that anywhere. The fact that it was using the wrong reference type also meant that the code couldn't elegantly make use of some our GC pointer helpers like jsCast<>.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::attemptToInlineCall):
(JSC::DFG::ByteCodeParser::handleMinMax):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileSkipScope):
(JSC::DFG::SpeculativeJIT::compileGetGlobalObject):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileSkipScope):
(JSC::FTL::DFG::LowerDFGToB3::compileGetGlobalObject):
(JSC::FTL::DFG::LowerDFGToB3::compileGetClosureVar):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):

jit/JITOperations.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::haveABadTime):
(JSC::JSGlobalObject::visitChildren):

runtime/JSGlobalObject.h:
runtime/JSObject.h:

(JSC::JSObject::putDirectInternal):

runtime/JSString.h:

(JSC::jsString):
(JSC::jsSubstring):

runtime/RegExpCachedResult.cpp:

(JSC::RegExpCachedResult::lastResult):

runtime/RegExpMatchesArray.cpp:

(JSC::tryCreateUninitializedRegExpMatchesArray):
(JSC::createRegExpMatchesArray):
(JSC::createStructureImpl):
(JSC::createRegExpMatchesArrayStructure):
(JSC::createRegExpMatchesArraySlowPutStructure):

runtime/RegExpMatchesArray.h:
runtime/RegExpObject.cpp:

(JSC::RegExpObject::put):
(JSC::RegExpObject::exec):
(JSC::RegExpObject::match):

runtime/RegExpObject.h:

(JSC::RegExpObject::getLastIndex):
(JSC::RegExpObject::test):

runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncTest):
(JSC::regExpProtoFuncExec):
(JSC::regExpProtoFuncCompile):

runtime/StringPrototype.cpp:

(JSC::stringProtoFuncMatch):

runtime/Structure.cpp:

(JSC::Structure::suggestedArrayStorageTransition):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::addNewPropertyTransition):

runtime/Structure.h:
tests/stress/regexp-matches-array-bad-time.js: Added.
tests/stress/regexp-matches-array-slow-put.js: Added.

LayoutTests:

js/regress/regexp-exec-expected.txt: Added.
js/regress/regexp-exec.html: Added.
js/regress/script-tests/regexp-exec.js: Added.

12:08 PM Changeset in webkit [197640] by Yusuke Suzuki

3 edits
1 add in trunk/Source/JavaScriptCore

[JSC] RegExp#lastIndex should handle writable attribute when defining in defineOwnProperty path
https://bugs.webkit.org/show_bug.cgi?id=155093

Reviewed by Filip Pizlo.

Before this patch, setLastIndex(ExecState* exec, size_t lastIndex) always overwrites the existing value
regardless of writable attribute.
And when defining RegExp#lastIndex in defineOwnProperty, we need to define the value first
before making the attribute readonly. After changing the writable attribute, we cannot define the value.

runtime/RegExpObject.cpp:

(JSC::RegExpObject::defineOwnProperty):

runtime/RegExpObject.h:

(JSC::RegExpObject::setLastIndex):

tests/stress/regexp-last-index-writable.js: Added.

(shouldBe):
(shouldThrow):
(regExpLastIndex):

7:00 AM Changeset in webkit [197639] by Alan Bujtas

2 edits in trunk/LayoutTests

[iOS] Gardening after r197627.

Unreviewed.

platform/ios-simulator/css2.1/20110323/border-conflict-style-088-expected.txt:

4:04 AM Changeset in webkit [197638] by akling@apple.com

4 edits in trunk/Source

Reduce page cache capacity from 3 to 2.
<https://webkit.org/b/155087>

Reviewed by Antti Koivisto.

Source/WebKit/mac:

Trim WebKit1 page cache capacities consistently with WebKit2.

WebView/WebView.mm:

(+[WebView _setCacheModel:]):

Source/WebKit2:

It's extremely rare that users go back more than 2 pages in the page cache,
and nowadays the network cache makes even un-cached pages fast to reload.

Trimming the page cache from 3 to 2 entries has a very nice effect on heap
fragmentation. I'm seeing a ~5% progression on the iPad PLUM test locally;
average memory usage across 300 loads goes from ~121MB to ~114MB.

Shared/CacheModel.cpp:

(WebKit::calculateCacheSizes):

2:17 AM Changeset in webkit [197637] by Antti Koivisto

11 edits in trunk/Source/WebCore

RenderTextControlSingleLine shouldn't mutate placeholder element inline style
https://bugs.webkit.org/show_bug.cgi?id=155086

Reviewed by Andreas Kling.

Text field placeholder element is currently managed by changing its inline style
from the host renderer based on the host style and state. Rendering poking
into DOM is wrong.

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::setRangeText):
(WebCore::HTMLInputElement::shouldTruncateText):

Add a helper.

(WebCore::HTMLInputElement::createInnerTextStyle):

html/HTMLInputElement.h:
html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
(WebCore::HTMLTextAreaElement::placeholderElement):
(WebCore::HTMLTextAreaElement::matchesReadWritePseudoClass):
(WebCore::HTMLTextAreaElement::updatePlaceholderText):

Use the new shadow element.

html/HTMLTextAreaElement.h:
html/HTMLTextFormControlElement.cpp:

(WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):

No more poking to inline style.

(WebCore::HTMLTextFormControlElement::setSelectionStart):

html/TextFieldInputType.cpp:

(WebCore::TextFieldInputType::updatePlaceholderText):

Use the new shadow element.

html/shadow/TextControlInnerElements.cpp:

(WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):

Add a subclass for the placeholder element instead of just using div.

(WebCore::TextControlPlaceholderElement::customStyleForRenderer):

Compute style base on the host state and style.

(WebCore::SearchFieldResultsButtonElement::SearchFieldResultsButtonElement):

html/shadow/TextControlInnerElements.h:
rendering/RenderTextControlSingleLine.cpp:

(WebCore::RenderTextControlSingleLine::styleDidChange):

No more setInlineStyleProperty.
This now needs to trigger layout like it does with other inner elements.

(WebCore::RenderTextControlSingleLine::computeControlLogicalHeight):
(WebCore::RenderTextControlSingleLine::autoscroll):
(WebCore::RenderTextControlSingleLine::textShouldBeTruncated): Deleted.

rendering/RenderTextControlSingleLine.h:

12:33 AM Changeset in webkit [197636] by ap@apple.com

3 edits in trunk/Tools

build-webkit prints an error on iOS simulator bots
https://bugs.webkit.org/show_bug.cgi?id=155078

Reviewed by Dan Bernstein.

This happens when build-layouttestrelay sets $xcodeSDK to undefined, to use host SDK.

Scripts/webkitdirs.pm: (buildXCodeProject): There is no need to pass -sdk, because

XcodeOptions() already passes SDKROOT as appropriate.

Scripts/build-layouttestrelay: Added a FIXME. Resetting $xcodeSDK doesn't reset

any other configuration variables that were derived from its initial value, like $portName.

Mar 5, 2016:

11:46 PM Changeset in webkit [197635] by Alan Bujtas

148 edits
1 add in trunk/LayoutTests

[iOS] Gardening after r197627.

Unreviewed.

platform/ios-simulator/css2.1/20110323/border-conflict-style-079-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-01-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-02-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-03-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-04-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-05-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-06-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-07-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-08-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-11-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-12-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-13-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-14-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-15-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-16-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-17-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-18-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-21-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-22-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-23-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-24-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-25-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-26-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-27-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-28-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-31-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-32-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-33-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-34-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-35-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-36-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-37-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-38-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-41-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-42-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-43-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-44-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-45-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-46-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-47-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-48-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-51-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-52-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-53-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-54-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-55-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-56-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-57-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-58-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-61-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-62-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-63-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-64-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-65-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-66-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-67-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-68-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-71-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-72-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-73-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-74-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-75-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-76-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-77-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-78-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-81-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-82-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-83-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-84-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-85-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-86-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-87-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-88-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-91-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-92-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-93-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-94-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-95-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-96-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-97-d-expected.txt:
platform/ios-simulator/css2.1/t170602-bdr-conflct-w-98-d-expected.txt:
platform/ios-simulator/fast/borders/border-antialiasing-expected.txt:
platform/ios-simulator/fast/dynamic/create-renderer-for-whitespace-only-text-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/002-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/002-vertical-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/border-collapsing-head-foot-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/border-collapsing-head-foot-vertical-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/cached-69296-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/cached-change-row-border-width-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/cached-change-tbody-border-width-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/equal-precedence-resolution-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/rtl-border-collapsing-expected.txt:
platform/ios-simulator/fast/table/border-collapsing/rtl-border-collapsing-vertical-expected.txt:
platform/ios-simulator/fast/table/colgroup-spanning-groups-rules-expected.txt:
platform/ios-simulator/fast/table/frame-and-rules-expected.txt:
platform/ios-simulator/fast/table/overflowHidden-expected.txt:
platform/ios-simulator/fast/table/rules-attr-dynchange1-expected.txt:
platform/ios-simulator/fast/table/rules-attr-dynchange2-expected.txt:
platform/ios-simulator/fast/text/international/bidi-override-expected.txt:
platform/ios-simulator/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-009-expected.txt:
platform/ios-simulator/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt:
platform/ios-simulator/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-013-expected.txt:
platform/ios-simulator/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-014-expected.txt:
platform/ios-simulator/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-015-expected.txt:
platform/ios-simulator/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-016-expected.txt:
platform/ios-simulator/tables/mozilla/bugs/bug24200-expected.txt:
platform/ios-simulator/tables/mozilla/bugs/bug43854-2-expected.txt:
platform/ios-simulator/tables/mozilla/bugs/bug9024-expected.txt: Added.
platform/ios-simulator/tables/mozilla/collapsing_borders/bug41262-3-expected.txt:
platform/ios-simulator/tables/mozilla/collapsing_borders/bug41262-4-expected.txt:
platform/ios-simulator/tables/mozilla/core/table_rules-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/backgr_layers-opacity-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/backgr_position-table-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/backgr_simple-table-cell-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/backgr_simple-table-column-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/backgr_simple-table-column-group-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/backgr_simple-table-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/backgr_simple-table-row-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/backgr_simple-table-row-group-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/table_rules_all-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/table_rules_none-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/x_table_rules_groups-expected.txt:
platform/ios-simulator/tables/mozilla/marvin/x_table_rules_none-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/bugs/bug1055-2-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/bugs/bug89315-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/collapsing_borders/bug41262-1-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/collapsing_borders/bug41262-5-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/collapsing_borders/bug41262-6-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_border-table-cell-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_border-table-column-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_border-table-column-group-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_border-table-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_border-table-quirks-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_border-table-row-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_border-table-row-group-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_fixed-bg-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_layers-hide-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_layers-show-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_position-table-cell-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_position-table-column-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_position-table-column-group-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_position-table-row-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/backgr_position-table-row-group-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/table_rules_cols-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/table_rules_rows-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/x_table_rules_all-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/x_table_rules_cols-expected.txt:
platform/ios-simulator/tables/mozilla_expected_failures/marvin/x_table_rules_rows-expected.txt:

9:07 PM Changeset in webkit [197634] by rniwa@webkit.org

14 edits
3 adds in trunk

Add the support for upgrading custom elements in cloneNode
https://bugs.webkit.org/show_bug.cgi?id=155062

Reviewed by Antti Koivisto.

Source/WebCore:

Implement https://w3c.github.io/webcomponents/spec/custom/#upgrading and steps 6 through 11 in
https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor to support upgrading elements
created by Node.prototype.cloneNode.

Tests: fast/custom-elements/lifecycle-callback-timing.html

fast/custom-elements/upgrading/Node-cloneNode.html

bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::upgradeElement): Added. Implements

https://w3c.github.io/webcomponents/spec/custom/#dfn-upgrade-a-custom-element

(WebCore::JSCustomElementInterface::didUpgradeLastElementInConstructionStack): Added. Implements step 10

"Replace the last entry in definition's construction stacka with an already constructed marker."
in https://w3c.github.io/webcomponents/spec/custom/#dom-htmlelement-constructor

bindings/js/JSCustomElementInterface.h:

(WebCore::JSCustomElementInterface::isUpgradingElement):
(WebCore::JSCustomElementInterface::lastElementInConstructionStack):
(WebCore::JSCustomElementInterface): Added m_constructionStack. This is the construction stack:

https://w3c.github.io/webcomponents/spec/custom/#dfn-element-definition-construction-stack

bindings/js/JSDOMBinding.cpp:

(WebCore::throwInvalidStateError): Added.

bindings/js/JSDOMBinding.h:
bindings/js/JSHTMLElementCustom.cpp:

(WebCore::constructJSHTMLElement): Implement the upgrading case in:

https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor

dom/Document.cpp:

(WebCore::createFallbackHTMLElement): Added. Enqueues upgrades of custom elements (enqueueElementUpgrade

currently does nothing if there is no InvokesCustomElementLifecycleCallbacks; e.g. in other DOM APIs).
This function implements https://w3c.github.io/webcomponents/spec/custom/#dfn-element-upgrade-algorithm

(WebCore::Document::createElement):

dom/LifecycleCallbackQueue.cpp:

(WebCore::LifecycleQueueItem::LifecycleQueueItem): Added a generic constructor.
(WebCore::LifecycleQueueItem::invoke): Call upgradeElement when m_type is Type::ElementUpgrade.
(WebCore::LifecycleCallbackQueue::enqueueElementUpgrade): Added.

dom/LifecycleCallbackQueue.h:
dom/Node.idl: Added InvokesCustomElementLifecycleCallbacks on cloneNode.
dom/make_names.pl:

(printFactoryCppFile): Added a variant of createKnownElement which takes QualifiedName. Also directly call

find(HTML|SVG|MathML)ElementConstructorFunction in createElement that takes AtomicString to avoid an extra
function call.

(printFactoryHeaderFile): Added a function declaration for createKnownElement that takes QualifiedName and

outdented class and function declarations to match the modern code style guideline.

LayoutTests:

Added test cases for upgrading elements with Node.prototype.cloneNode.

fast/custom-elements/lifecycle-callback-timing-expected.txt:
fast/custom-elements/lifecycle-callback-timing.html:

9:02 PM Changeset in webkit [197633] by timothy_horton@apple.com

4 edits
1 add in trunk

Create a DOMHTMLVideoElement when wrapping <video> elements
https://bugs.webkit.org/show_bug.cgi?id=155084
<rdar://problem/24997193>

Reviewed by Dan Bernstein.

bindings/objc/DOM.mm:

(WebCore::createElementClassMap):
Add <video> to the mapping.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/mac/DOMHTMLVideoElementWrapper.mm: Added.

(-[VideoWrapperFrameLoadDelegate webView:didFinishLoadForFrame:]):
(TestWebKitAPI::TEST):
Add an API test for this behavior.

8:34 PM Changeset in webkit [197632] by weinig@apple.com

2 edits in trunk/Source/WebKit2

Revert usage of autofill field name for use with UITextInputTraits
until our bots can catch up.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView textInputTraits]):

8:25 PM Changeset in webkit [197631] by weinig@apple.com

5 edits in trunk/LayoutTests

Update tests to match the latest version of the HTML5 spec.

LayoutTests/imported/w3c:

web-platform-tests/html/semantics/forms/the-form-element/form-autocomplete.html:

Fields that don't have any value set for their autocomplete attribute should return the the empty string.

LayoutTests:

fast/forms/autocomplete-expected.txt:
fast/forms/autocomplete.html:

Fields that don't have any value set for their autocomplete attribute should return the the empty string.

8:25 PM Changeset in webkit [197630] by rniwa@webkit.org

3 edits in trunk/Source/WebCore

Minor cleans up in custom elements' code per Darin's comments
https://bugs.webkit.org/show_bug.cgi?id=155081

Reviewed by Darin Adler.

Cleanup per Darin's comments.

dom/CustomElementDefinitions.cpp:

(WebCore::CustomElementDefinitions::findInterface): Use get instead of explicitly checking against end().

dom/LifecycleCallbackQueue.h: Remove unecessary header includes.

8:18 PM Changeset in webkit [197629] by weinig@apple.com

2 edits in trunk/Source/WebCore

Fix two minor typos from http://trac.webkit.org/changeset/197626 that were causing some test failures.

html/Autofill.cpp:

(WebCore::fieldNameMap):
(WebCore::AutofillData::createFromHTMLFormControlElement):

7:28 PM Changeset in webkit [197628] by Chris Dumez

40 edits
1 add
3 deletes in trunk/Source

Consolidate RuntimeApplicationChecks and RuntimeApplicationChecksIOS
https://bugs.webkit.org/show_bug.cgi?id=155035

Reviewed by Darin Adler.

Source/WebCore:

Consolidate RuntimeApplicationChecks and RuntimeApplicationChecksIOS into
one file. The following changes were made:

The checks now all rely on applicationBundleIdentifier(), which has the benefit of working in WK1 and WK2 UI/WebContent/Networking processes.
Use namespaces to distinguish Mac and iOS applications instead of relying on the method name. So, applicationIsIBooksForIOS() becomes IOSApplication::isIBooks().
Use NSBundle API on both iOS and Mac instead of using the CF API on Mac and the NS API on iOS.

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper _accessibilityWebDocumentView]):

bindings/js/JSDOMWindowBase.cpp:

(WebCore::JSDOMWindowBase::commonVM):

bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::putDelegate):

html/HTMLMediaElement.cpp:
html/HTMLObjectElement.cpp:

(WebCore::shouldNotPerformURLAdjustment):

html/MediaElementSession.cpp:
inspector/InspectorTimelineAgent.cpp:

(WebCore::currentRunLoop):

loader/FrameLoader.cpp:

(WebCore::FrameLoader::willLoadMediaElementURL):

loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::create):
(WebCore::SubresourceLoader::startLoading):

loader/cache/CachedScript.cpp:

(WebCore::CachedScript::shouldIgnoreHTTPStatusCodeErrors):

platform/RuntimeApplicationChecks.cpp: Removed.
platform/RuntimeApplicationChecks.h:
platform/RuntimeApplicationChecks.mm: Added.

(WebCore::applicationBundleIdentifier):
(WebCore::applicationBundleIsEqualTo):
(WebCore::MacApplication::isSafari):
(WebCore::MacApplication::isAppleMail):
(WebCore::MacApplication::isIBooks):
(WebCore::MacApplication::isITunes):
(WebCore::MacApplication::isMicrosoftMessenger):
(WebCore::MacApplication::isAdobeInstaller):
(WebCore::MacApplication::isAOLInstantMessenger):
(WebCore::MacApplication::isMicrosoftMyDay):
(WebCore::MacApplication::isMicrosoftOutlook):
(WebCore::MacApplication::isQuickenEssentials):
(WebCore::MacApplication::isAperture):
(WebCore::MacApplication::isVersions):
(WebCore::MacApplication::isHRBlock):
(WebCore::MacApplication::isSolidStateNetworksDownloader):
(WebCore::MacApplication::isHipChat):
(WebCore::IOSApplication::isMobileMail):
(WebCore::IOSApplication::isMobileSafari):
(WebCore::IOSApplication::isDumpRenderTree):
(WebCore::IOSApplication::isMobileStore):
(WebCore::IOSApplication::isWebApp):
(WebCore::IOSApplication::isOkCupid):
(WebCore::IOSApplication::isFacebook):
(WebCore::IOSApplication::isDaijisenDictionary):
(WebCore::IOSApplication::isNASAHD):
(WebCore::IOSApplication::isTheEconomistOnIphone):
(WebCore::IOSApplication::isWebProcess):
(WebCore::IOSApplication::isIBooks):
(WebCore::setApplicationBundleIdentifier):

platform/RuntimeApplicationChecksIOS.h: Removed.
platform/RuntimeApplicationChecksIOS.mm: Removed.
platform/audio/ios/AudioDestinationIOS.cpp:
platform/cf/URLCF.cpp:
platform/graphics/ca/cocoa/LayerFlushSchedulerMac.cpp:

(WebCore::currentRunLoop):

platform/ios/PasteboardIOS.mm:
platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
platform/ios/wak/WebCoreThread.mm:

(WebThreadEnable):

platform/mac/WidgetMac.mm:

(WebCore::Widget::paint):

platform/network/ios/QuickLook.mm:
platform/network/mac/ResourceHandleMac.mm:
rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::needsIOSDumpRenderTreeMainFrameRenderViewLayerIsAlwaysOpaqueHack):

Source/WebKit:

Update runtime application checks.

WebCoreSupport/WebResourceLoadScheduler.cpp:

(WebResourceLoadScheduler::servePendingRequests):

Source/WebKit/ios:

Update runtime application checks.

WebCoreSupport/WebChromeClientIOS.mm:

Source/WebKit/mac:

Update runtime application checks.

Plugins/WebPluginController.mm:

(initializeAudioSession):

WebCoreSupport/WebFrameLoaderClient.mm:
WebView/WebFrame.mm:

(needsMicrosoftMessengerDOMDocumentWorkaround):

WebView/WebImmediateActionController.mm:

(-[WebImmediateActionController _updateImmediateActionItem]):

WebView/WebView.mm:

(WebKitInitializeApplicationCachePathIfNecessary):
(shouldEnableLoadDeferring):
(shouldRestrictWindowFocus):
(needsOutlookQuirksScript):
(shouldTransformsAffectOverflow):
(shouldDispatchJavaScriptWindowOnErrorEvents):
(shouldUseLegacyBackgroundSizeShorthandBehavior):
(-[WebView _commonInitializationWithFrameName:groupName:]):
(+[WebView enableWebThread]):
(+[WebView registerForMemoryNotifications]):
(-[WebView _needsKeyboardEventDisambiguationQuirks]):
(needsSelfRetainWhileLoadingQuirk):
(-[WebView _needsPreHTML5ParserQuirks]):

Source/WebKit2:

Update runtime application checks.

UIProcess/API/Cocoa/APIWebsiteDataStoreCocoa.mm:

(API::WebsiteDataStore::defaultApplicationCacheDirectory):

UIProcess/Cocoa/VersionChecks.mm:

(WebKit::linkedOnOrAfter):

UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeWebProcess):
(WebKit::WebProcessPool::legacyPlatformDefaultApplicationCacheDirectory):

UIProcess/ios/WKContentViewInteraction.mm:
UIProcess/mac/WebPageProxyMac.mm:

(WebKit::expectsLegacyImplicitRubberBandControl):
(WebKit::WebPageProxy::appleMailPaginationQuirkEnabled):

7:10 PM Changeset in webkit [197627] by Alan Bujtas

8 edits
2 adds in trunk

Make table collapsed borders subpixel aware.
https://bugs.webkit.org/show_bug.cgi?id=150383

Reviewed by Simon Fraser.

This patch enables authors to

set subpixel width on collapsed borders
and push those borders to subpixel positions.

Source/WebCore:

Test: fast/table/collapsed-border-with-odd-pixel-width.html

rendering/RenderTable.cpp:

(WebCore::RenderTable::calcBorderStart):
(WebCore::RenderTable::calcBorderEnd):
(WebCore::RenderTable::outerBorderBefore):
(WebCore::RenderTable::outerBorderAfter):
(WebCore::RenderTable::outerBorderStart):
(WebCore::RenderTable::outerBorderEnd):

rendering/RenderTableCell.cpp:

(WebCore::RenderTableCell::borderHalfStart):
(WebCore::RenderTableCell::borderHalfEnd):
(WebCore::RenderTableCell::borderHalfBefore):
(WebCore::RenderTableCell::borderHalfAfter):
(WebCore::RenderTableCell::paintCollapsedBorders):

rendering/RenderTableSection.cpp:

(WebCore::RenderTableSection::calcOuterBorderBefore):
(WebCore::RenderTableSection::calcOuterBorderAfter):
(WebCore::RenderTableSection::calcOuterBorderStart):
(WebCore::RenderTableSection::calcOuterBorderEnd):

rendering/style/CollapsedBorderValue.h:

(WebCore::CollapsedBorderValue::adjustedCollapsedBorderWidth):

LayoutTests:

fast/table/collapsed-border-with-odd-pixel-width-expected.html: Added.
fast/table/collapsed-border-with-odd-pixel-width.html: Added.
fast/table/hidpi-collapsed-border-with-odd-pixel-width-expected.html:

6:17 PM Changeset in webkit [197626] by weinig@apple.com

18 edits
2 adds in trunk

Add support for processing the autofill field name out of form control elements ultimately to aid input methods
<rdar://problem/23041180>
https://bugs.webkit.org/show_bug.cgi?id=155079

Reviewed by Enrica Casucci.

Source/WebCore:

Added additional cases to fast/forms/autocomplete-tokens.html.

WebCore.xcodeproj/project.pbxproj:

Add Autofill.h/cpp

html/Autofill.cpp: Added.

(WebCore::fieldNameMap):
(WebCore::toAutofillFieldName):
(WebCore::isContactToken):
(WebCore::maxTokensForAutofillFieldCategory):
(WebCore::AutofillData::createFromHTMLFormControlElement):

html/Autofill.h: Added.

(WebCore::AutofillData::AutofillData):
Refactored the autofill data processing algorithm into it's own file and added support
returning not just the IDL-exposed autofill value but also the autofill field name. The
code is structured simply enough that if we find a need for the hint set or scope information
we could return it as well.

html/HTMLFormControlElement.cpp:

(WebCore::HTMLFormControlElement::autocomplete):
(WebCore::HTMLFormControlElement::setAutocomplete):
(WebCore::HTMLFormControlElement::autofillMantle):
(WebCore::HTMLFormControlElement::autofillData):
Use AutofillData to implement these.

html/HTMLFormControlElement.h:

Expose accessor for mantle and AutofillData.

html/HTMLFormElement.cpp:

(WebCore::HTMLFormElement::autocomplete):

html/HTMLFormElement.h:

Switch to return an AtomicString as it will always
return one of two known values.

testing/Internals.cpp:

(WebCore::Internals::autofillFieldName):

testing/Internals.h:
testing/Internals.idl:

Add accessor of the field name for testing purposes.

Source/WebKit2:

Shared/AssistedNodeInformation.cpp:

(WebKit::AssistedNodeInformation::encode):
(WebKit::AssistedNodeInformation::decode):

Shared/AssistedNodeInformation.h:

Add AutofillFieldName. Convert some coders to use encodeEnum/decodeEnum instead of casting.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView textInputTraits]):
Map AutofillFieldNames to the associated UITextContentTypes.

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::getAssistedNodeInformation):
Extract the AutofillFieldNames onto the AssistedNodeInformation for <input> elements
and <textarea> elements.

LayoutTests:

fast/forms/autocomplete-tokens-expected.txt:
fast/forms/autocomplete-tokens.html:

Update test to also test field names, as they are now exposed via internals.

5:52 PM Changeset in webkit [197625] by commit-queue@webkit.org

4 edits
2 adds in trunk/Source/WebInspectorUI

Web Inspector: Have separate path component for Script Timeline content views
https://bugs.webkit.org/show_bug.cgi?id=155075
<rdar://problem/24996564>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-05
Reviewed by Timothy Hatcher.

UserInterface/Images/CallTrees.svg: Added.
UserInterface/Images/Events.svg: Added.

New icons based off of ResultLine.svg.

UserInterface/Views/PathComponentIcons.css:

(.events-icon .icon):
(.call-trees-icon .icon):
(body:not(.mac-platform, .windows-platform) .call-trees-icon .icon):
Use the new icons and fallback to ResultLine.svg for other ports.

UserInterface/Views/ScriptClusterTimelineView.js:

(WebInspector.ScriptClusterTimelineView):
(WebInspector.ScriptClusterTimelineView.prototype.get eventsContentView):
(WebInspector.ScriptClusterTimelineView.prototype.showEvents):
(WebInspector.ScriptClusterTimelineView.prototype.showProfile):
(WebInspector.ScriptClusterTimelineView.prototype._pathComponentForContentView):
(WebInspector.ScriptClusterTimelineView.prototype._identifierForContentView):
(WebInspector.ScriptClusterTimelineView.prototype._showContentViewForIdentifier):
(WebInspector.ScriptClusterTimelineView.prototype._scriptClusterViewCurrentContentViewDidChange):
(WebInspector.ScriptClusterTimelineView.prototype.get detailsContentView): Deleted.
(WebInspector.ScriptClusterTimelineView.prototype.showDetails): Deleted.
Rename "Details" to "Events".

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView.prototype.contentBrowserTreeElementForRepresentedObject): Deleted.
Always include the top level "Details" component.

5:23 PM Changeset in webkit [197624] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

Build fix after r197612 (under ASAN/GuardMalloc).

dom/CustomElementDefinitions.cpp:

(WebCore::CustomElementDefinitions::findInterface):

5:20 PM Changeset in webkit [197623] by Michael Catanzaro

6 edits in trunk

Unreviewed, fix GTK/EFL build after r197575 and add mandatory GnuTLS dependency

Source/cmake/OptionsEfl.cmake:
Source/cmake/OptionsGTK.cmake:

Source/WebCore:

PlatformEfl.cmake:
PlatformGTK.cmake:

4:48 PM Changeset in webkit [197622] by fpizlo@apple.com

11 edits in trunk/Source/JavaScriptCore

The most aggressive form of RegExpTest/RegExpExec should speculate more aggressively than just cell
https://bugs.webkit.org/show_bug.cgi?id=154900

Reviewed by Saam Barati.

These old operations used to speculate cell. That's what they did when they were first
introduced. That was probably about as good as they could do back then because we didn't have
very powerful checks. Now we have powerful checks, so we can do this right.

The most profitable thing to check is that child1 is a RegExpObject and child2 is a JSString.
Sometimes though, we will not know what child2 is even though we know that child1 is a
RegExpObject. So, this patch means that RegExpExec/RegExpTest have the following overloads:

RegExpExec(RegExpObject:, String:)
RegExpExec(RegExpObject:, Untyped:)
RegExpExec(Untyped:, Untyped:)

This shaves off some type checks in Octane/regexp. It also cleans up some problems in our
modeling of the effectfulness of these operations.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):

jit/JITOperations.h:

4:40 PM Changeset in webkit [197621] by timothy@apple.com

9 edits in trunk/Source/WebKit2

Implement the Automation protocol commands by tracking WebPageProxy objects
that are controlled by automation and assigning them a UUID handle.

https://bugs.webkit.org/show_bug.cgi?id=154953
rdar://problem/24947489

Reviewed by Brian Burg.

UIProcess/API/APIAutomationSessionClient.h:

(API::AutomationSessionClient::didRequestNewWindow):
Return a WebPageProxy instead of void so it can be assigned a UUID handle.

UIProcess/API/Cocoa/_WKAutomationSessionDelegate.h:

Return a WKPageRef from _automationSessionDidRequestNewWindow:.

UIProcess/Automation/WebAutomationSession.cpp:

(WebKit::WebAutomationSession::webPageProxyForHandle):
(WebKit::WebAutomationSession::handleForWebPageProxy):
(WebKit::WebAutomationSession::getBrowsingContexts):
(WebKit::WebAutomationSession::createBrowsingContext):
(WebKit::WebAutomationSession::closeBrowsingContext):
(WebKit::WebAutomationSession::switchToBrowsingContext):

UIProcess/Automation/WebAutomationSession.h:

Added new methods and maps to track pages and handles.

UIProcess/Cocoa/AutomationSessionClient.h:
UIProcess/Cocoa/AutomationSessionClient.mm:

(WebKit::AutomationSessionClient::didRequestNewWindow):
Return a WebPageProxy from the WKPageRef.

UIProcess/WebPageProxy.h: Make setFocus public.

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::setAutomationSession):
Set the WebProcessPool on the WebAutomationSession so it can be used to find
WebPageProxy objects controlled by automation.

4:40 PM Changeset in webkit [197620] by timothy@apple.com

4 edits in trunk/Source/WebKit2

Rename Automation protocol methods to use "BrowsingContext" instead of "Window".
Also flesh out the protocol commands more by adding switchToBrowsingContext
and return a BrowsingContextHandle for createBrowsingContext.

https://bugs.webkit.org/show_bug.cgi?id=154953
rdar://problem/24947489

Reviewed by Brian Burg.

UIProcess/Automation/Automation.json:
UIProcess/Automation/WebAutomationSession.cpp:

(WebKit::WebAutomationSession::getBrowsingContexts):
(WebKit::WebAutomationSession::createBrowsingContext):
(WebKit::WebAutomationSession::closeBrowsingContext):
(WebKit::WebAutomationSession::switchToBrowsingContext):
(WebKit::WebAutomationSession::getWindows): Deleted.
(WebKit::WebAutomationSession::openWindow): Deleted.
(WebKit::WebAutomationSession::closeWindow): Deleted.

UIProcess/Automation/WebAutomationSession.h:

4:28 PM Changeset in webkit [197619] by Joseph Pecoraro

15 edits
2 moves
6 adds in trunk/Source/WebInspectorUI

Web Inspector: Add back support for a heavy / bottom up profile view
https://bugs.webkit.org/show_bug.cgi?id=140578
<rdar://problem/19506794>

Reviewed by Timothy Hatcher.

Localizations/en.lproj/localizedStrings.js:
UserInterface/Main.html:

New strings and resources.

UserInterface/Base/Utilities.js:

(Number.secondsToMillisecondsString):
Helper for providing a consistent milliseconds string used in profiles.

UserInterface/Controllers/TimelineManager.js:

(WebInspector.TimelineManager.prototype.scriptProfilerTrackingCompleted):
The calling context tree should be stored on a Recording, not on the global
TimelineManager. Also create two trees, one top down and one bottom up.

UserInterface/Models/CallingContextTree.js:

(WebInspector.CallingContextTree):
(WebInspector.CallingContextTree.prototype.get type):
(WebInspector.CallingContextTree.prototype.get totalExecutionTime):
(WebInspector.CallingContextTree.prototype.reset):
(WebInspector.CallingContextTree.prototype.numberOfSamplesInTimeRange):
(WebInspector.CallingContextTree.prototype.increaseExecutionTime):
Give a CallingContextTree a type (TopDown / BottomUp) and some getters.

(WebInspector.CallingContextTree.prototype.updateTreeWithStackTrace):
Build a bottom up or top down tree from samples.

(WebInspector.CallingContextTree.prototype.forEachChild):
Allow iterating from the root.

(WebInspector.CCTNode):
(WebInspector.CCTNode.prototype.hasChildrenInTimeRange):
(WebInspector.CCTNode.prototype.numberOfLeafTimestamps):
(WebInspector.CCTNode.prototype.addTimestampAndExpressionLocation):
(WebInspector.CCTNode.prototype.equals):
(WebInspector.CCTNode.prototype.hasChildren): Deleted.
Give a CCTNode a list of leaf timestamps alongside the list of all timestamps.
Leaf timestamps will count as "self time" in a profile view.

UserInterface/Models/SourceCodeLocation.js:

(WebInspector.SourceCodeLocation.prototype._locationString):
Nobody was using "ColumnStyle.Hidden" so repurpose it to be even simpler.

UserInterface/Models/TimelineRecording.js:

(WebInspector.TimelineRecording):
(WebInspector.TimelineRecording.prototype.get topDownCallingContextTree):
(WebInspector.TimelineRecording.prototype.get bottomUpCallingContextTree):
(WebInspector.TimelineRecording.prototype.reset):
Store the two types of calling context trees and allow reseting them.

UserInterface/Protocol/InspectorFrontendAPI.js:

(InspectorFrontendAPI.contextMenuItemSelected):
Helper for debugging uncaught exceptions in context menus.

UserInterface/Views/ContentView.js:

(WebInspector.ContentView.createFromRepresentedObject):
(WebInspector.ContentView.isViewable):
A ScriptTimeline now has a cluster view.
A CallingContextTree now has a ProfileView.

UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid.prototype.insertChild):
(WebInspector.DataGrid.prototype._contextMenuInDataTable):
(WebInspector.DataGridNode.prototype.refreshRecursively):
(WebInspector.DataGridNode.prototype.elementWithColumnIdentifier):
(WebInspector.DataGridNode.prototype.forEachImmediateChild):
(WebInspector.DataGridNode.prototype.forEachChildInSubtree):
(WebInspector.DataGridNode.prototype.isInSubtreeOfNode):
Provide some helpers for iterating DataGridNodes, useful when the
actual DataGrid comes from a DataGridTree.

(WebInspector.DataGridNode.prototype.select):
(WebInspector.DataGridNode.prototype.deselect):
The indent width of DataGridNodes was not getting reset when a
node was removed and re-added to a tree due to a cached padding.

(WebInspector.DataGridNode.prototype.appendContextMenuItems):
Allow DataGridNodes to provide context menu items by overriding this method.

UserInterface/Views/PathComponentIcons.css:

(.function-icon .icon):
(.native-icon .icon):
(.program-icon .icon):
Icons for profile nodes in path components.

UserInterface/Views/ProfileDataGridNode.js: Added.

(WebInspector.ProfileDataGridNode):
(WebInspector.ProfileDataGridNode.prototype.get node):
(WebInspector.ProfileDataGridNode.prototype.displayName):
(WebInspector.ProfileDataGridNode.prototype.iconClassName):
(WebInspector.ProfileDataGridNode.prototype.get data):
(WebInspector.ProfileDataGridNode.prototype.createCellContent):
(WebInspector.ProfileDataGridNode.prototype.sort):
(WebInspector.ProfileDataGridNode.prototype.refresh):
(WebInspector.ProfileDataGridNode.prototype.appendContextMenuItems):
(WebInspector.ProfileDataGridNode.prototype._updateChildrenForModifiers):
(WebInspector.ProfileDataGridNode.prototype._recalculateData):
(WebInspector.ProfileDataGridNode.prototype._totalTimeContent):
(WebInspector.ProfileDataGridNode.prototype._displayContent):
(WebInspector.ProfileDataGridNode.prototype._populate):
CCTNode DataGridNode. A row in the ProfileDataGridTree. Handles
tree modifiers like charge to caller.

UserInterface/Views/ProfileDataGridTree.js: Added.

(WebInspector.ProfileDataGridTree):
(WebInspector.ProfileDataGridTree.buildSortComparator):
(WebInspector.ProfileDataGridTree.prototype.get callingContextTree):
(WebInspector.ProfileDataGridTree.prototype.get sampleInterval):
(WebInspector.ProfileDataGridTree.prototype.get focusNodes):
(WebInspector.ProfileDataGridTree.prototype.get currentFocusNode):
(WebInspector.ProfileDataGridTree.prototype.get modifiers):
(WebInspector.ProfileDataGridTree.prototype.get startTime):
(WebInspector.ProfileDataGridTree.prototype.get endTime):
(WebInspector.ProfileDataGridTree.prototype.get numberOfSamples):
(WebInspector.ProfileDataGridTree.prototype.get children):
(WebInspector.ProfileDataGridTree.prototype.appendChild):
(WebInspector.ProfileDataGridTree.prototype.insertChild):
(WebInspector.ProfileDataGridTree.prototype.removeChildren):
(WebInspector.ProfileDataGridTree.prototype.set sortComparator):
(WebInspector.ProfileDataGridTree.prototype.sort):
(WebInspector.ProfileDataGridTree.prototype.refresh):
(WebInspector.ProfileDataGridTree.prototype.addFocusNode):
(WebInspector.ProfileDataGridTree.prototype.rollbackFocusNode):
(WebInspector.ProfileDataGridTree.prototype.clearFocusNodes):
(WebInspector.ProfileDataGridTree.prototype.hasModifiers):
(WebInspector.ProfileDataGridTree.prototype.addModifier):
(WebInspector.ProfileDataGridTree.prototype.clearModifiers):
(WebInspector.ProfileDataGridTree.prototype._repopulate):
(WebInspector.ProfileDataGridTree.prototype._focusChanged):
(WebInspector.ProfileDataGridTree.prototype._updateCurrentFocusDetails):
(WebInspector.ProfileDataGridTree.prototype._restoreFocusedNodeToOriginalParent):
(WebInspector.ProfileDataGridTree.prototype._modifiersChanged):
Start of a DataGridTree for a CallingContextTree.
Contains special logic for focused nodes and modifiers.

UserInterface/Views/ProfileView.css: Added.

(.profile > .data-grid):
(.profile > .data-grid th):
(.profile > .data-grid td .icon):
(.profile > .data-grid td .percentage):
(.profile > .data-grid td .location):
(.profile > .data-grid:matches(:focus, .force-focus) tr.selected td .location):
(.profile > .data-grid td .icon.function-icon):
(.profile > .data-grid td .icon.native-icon):
(.profile > .data-grid td .icon.program-icon):
(.profile > .data-grid tr:matches(.selected, :hover) .go-to-arrow):
(.profile > .data-grid td.function-column):
(.profile > .data-grid td .guidance):
(.profile > .data-grid td .guidance.hover):
(.profile > .data-grid td .guidance.base):
(.profile > .data-grid tr:not(.expanded) td .guidance.base):
(.profile > .data-grid tr.expanded td .guidance.base):

UserInterface/Views/ProfileView.js: Added.

(WebInspector.ProfileView):
(WebInspector.ProfileView.prototype.get callingContextTree):
(WebInspector.ProfileView.prototype.get startTime):
(WebInspector.ProfileView.prototype.get endTime):
(WebInspector.ProfileView.prototype.setStartAndEndTime):
(WebInspector.ProfileView.prototype.hasFocusNodes):
(WebInspector.ProfileView.prototype.clearFocusNodes):
(WebInspector.ProfileView.prototype.get selectionPathComponents):
(WebInspector.ProfileView.prototype._recreate):
(WebInspector.ProfileView.prototype._repopulateDataGridFromTree):
(WebInspector.ProfileView.prototype._pathComponentClicked):
(WebInspector.ProfileView.prototype._dataGridTreeFocusChanged):
(WebInspector.ProfileView.prototype._dataGridTreeModifiersChanged):
(WebInspector.ProfileView.prototype._dataGridSortChanged):
(WebInspector.ProfileView.prototype._dataGridNodeSelected):
(WebInspector.ProfileView.prototype._dataGridNodeExpanded):
(WebInspector.ProfileView.prototype._mouseOverDataGrid):
(WebInspector.ProfileView.prototype._mouseLeaveDataGrid):
(WebInspector.ProfileView.prototype._guidanceElementKey):
(WebInspector.ProfileView.prototype._removeGuidanceElement):
(WebInspector.ProfileView.prototype._appendGuidanceElement):
ProfileView holds a data grid which is populated from the data grid tree.
Special handing for guidance markers when hovering / selecting parts of the tree.

UserInterface/Views/ScriptClusterTimelineView.js: Added.

(WebInspector.ScriptClusterTimelineView.createPathComponent):
(WebInspector.ScriptClusterTimelineView):
(WebInspector.ScriptClusterTimelineView.prototype.get zeroTime):
(WebInspector.ScriptClusterTimelineView.prototype.set zeroTime):
(WebInspector.ScriptClusterTimelineView.prototype.get startTime):
(WebInspector.ScriptClusterTimelineView.prototype.set startTime):
(WebInspector.ScriptClusterTimelineView.prototype.get endTime):
(WebInspector.ScriptClusterTimelineView.prototype.set endTime):
(WebInspector.ScriptClusterTimelineView.prototype.get currentTime):
(WebInspector.ScriptClusterTimelineView.prototype.set currentTime):
(WebInspector.ScriptClusterTimelineView.prototype.get navigationSidebarTreeOutline):
(WebInspector.ScriptClusterTimelineView.prototype.reset):
(WebInspector.ScriptClusterTimelineView.prototype.filterDidChange):
(WebInspector.ScriptClusterTimelineView.prototype.matchTreeElementAgainstCustomFilters):
(WebInspector.ScriptClusterTimelineView.prototype.get detailsContentView):
(WebInspector.ScriptClusterTimelineView.prototype.get profileContentView):
(WebInspector.ScriptClusterTimelineView.prototype.get selectionPathComponents):
(WebInspector.ScriptClusterTimelineView.prototype.saveToCookie):
(WebInspector.ScriptClusterTimelineView.prototype.restoreFromCookie):
(WebInspector.ScriptClusterTimelineView.prototype.showDetails):
(WebInspector.ScriptClusterTimelineView.prototype.showProfile):
(WebInspector.ScriptClusterTimelineView.prototype._pathComponentForContentView):
(WebInspector.ScriptClusterTimelineView.prototype._identifierForContentView):
(WebInspector.ScriptClusterTimelineView.prototype._showContentViewForIdentifier):
(WebInspector.ScriptClusterTimelineView.prototype._pathComponentSelected):
(WebInspector.ScriptClusterTimelineView.prototype._scriptClusterViewCurrentContentViewDidChange):
Script Timeline ClusterContentView. Toggle between the normal "Details" data grid
and the new "Call Tree" profile view. Currently the recording expects child content
views to be TimelineViews, this ClusterContentView forwards TimelineView relevant
methods to the real TimelineView children.

UserInterface/Views/ScriptDetailsTimelineView.js: Renamed from Source/WebInspectorUI/UserInterface/Views/ScriptTimelineView.js.

(WebInspector.ScriptDetailsTimelineView):
(WebInspector.ScriptDetailsTimelineView.prototype.get navigationSidebarTreeOutlineLabel):
(WebInspector.ScriptDetailsTimelineView.prototype.shown):
(WebInspector.ScriptDetailsTimelineView.prototype.hidden):
(WebInspector.ScriptDetailsTimelineView.prototype.closed):
(WebInspector.ScriptDetailsTimelineView.prototype.get selectionPathComponents):
(WebInspector.ScriptDetailsTimelineView.prototype.reset):
(WebInspector.ScriptDetailsTimelineView.prototype.canShowContentViewForTreeElement):
(WebInspector.ScriptDetailsTimelineView.prototype.showContentViewForTreeElement):
(WebInspector.ScriptDetailsTimelineView.prototype.treeElementPathComponentSelected):
(WebInspector.ScriptDetailsTimelineView.prototype.treeElementSelected):
(WebInspector.ScriptDetailsTimelineView.prototype.dataGridNodeForTreeElement):
(WebInspector.ScriptDetailsTimelineView.prototype.populateProfileNodeTreeElement):
(WebInspector.ScriptDetailsTimelineView.prototype.layout):
(WebInspector.ScriptDetailsTimelineView.prototype._processPendingRecords):
(WebInspector.ScriptDetailsTimelineView.prototype._scriptTimelineRecordAdded):
(WebInspector.ScriptDetailsTimelineView.prototype._scriptTimelineRecordRefreshed):
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridFiltersDidChange):
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridNodeSelected):

UserInterface/Views/ScriptProfileTimelineView.js: Added.

(WebInspector.ScriptProfileTimelineView):
(WebInspector.ScriptProfileTimelineView.prototype.closed):
(WebInspector.ScriptProfileTimelineView.prototype.get navigationItems):
(WebInspector.ScriptProfileTimelineView.prototype.get selectionPathComponents):
(WebInspector.ScriptProfileTimelineView.prototype.layout):
(WebInspector.ScriptProfileTimelineView.prototype._callingContextTreeForOrientation):
(WebInspector.ScriptProfileTimelineView.prototype._profileViewSelectionPathComponentsDidChange):
(WebInspector.ScriptProfileTimelineView.prototype._scriptTimelineRecordRefreshed):
(WebInspector.ScriptProfileTimelineView.prototype._updateProfileOrientationButtonItem):
(WebInspector.ScriptProfileTimelineView.prototype._toggleProfileOrientation):
(WebInspector.ScriptProfileTimelineView.prototype._updateClearFocusNodesButtonItem):
(WebInspector.ScriptProfileTimelineView.prototype._clearFocusNodes):
The two TimelineViews.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView.prototype.get currentTimelineView):
(WebInspector.TimelineRecordingContentView.prototype.contentBrowserTreeElementForRepresentedObject):
The timeline content browser may now hold a ClusterContentView. It is not exactly a TimelineView,
but it holds TimelineViews, so treat it like one. Assume the ClusterContentView will add its own
path components.

(WebInspector.TimelineRecordingContentView.prototype._instrumentAdded):
Add extra information other than the sidebar to TimelineViews. The ProfileView looks
at the recording for the calling context trees.

4:01 PM Changeset in webkit [197618] by Simon Fraser

4 edits
17 adds in trunk

Add support for the object-position CSS property
https://bugs.webkit.org/show_bug.cgi?id=122811
rdar://problem/15836338

Reviewed by Sam Weinig.

Source/WebCore:

Take object-position into account when rendering replaced elements.
RenderReplaced::replacedContentRect() is the one place where we compute
the content rect for replaced elements.

Also return false from foregroundIsKnownToBeOpaqueInRect() if we have
any non-default object-position, as the foreground may no longer fill the box.

Tests: compositing/video/video-object-position.html

fast/css/object-position/object-position-canvas.html
fast/css/object-position/object-position-embed.html
fast/css/object-position/object-position-img-svg.html
fast/css/object-position/object-position-img.html
fast/css/object-position/object-position-input-image.html
fast/css/object-position/object-position-object.html
fast/css/object-position/object-position-video-poster.html

rendering/RenderImage.cpp:

(WebCore::RenderImage::foregroundIsKnownToBeOpaqueInRect):

rendering/RenderReplaced.cpp:

(WebCore::RenderReplaced::replacedContentRect):

LayoutTests:

Various object-position tests.

compositing/video/video-object-position-expected.txt: Added.
compositing/video/video-object-position.html: Added.
fast/css/object-position/object-position-embed-expected.html: Added.
fast/css/object-position/object-position-embed.html: Added.
fast/css/object-position/object-position-img-expected.html: Added.
fast/css/object-position/object-position-img-svg-expected.html: Added.
fast/css/object-position/object-position-img-svg.html: Added.
fast/css/object-position/object-position-img.html: Added.
fast/css/object-position/object-position-input-image-expected.html: Added.
fast/css/object-position/object-position-input-image.html: Added.
fast/css/object-position/object-position-object-expected.html: Added.
fast/css/object-position/object-position-object.html: Added.
fast/css/object-position/object-position-video-poster-expected.html: Added.
fast/css/object-position/object-position-video-poster.html: Added.
fast/css/object-position/resources/expected.css: Added.
fast/css/object-position/resources/test.css: Added.

3:23 PM Changeset in webkit [197617] by Simon Fraser

13 edits
5 adds in trunk

Add parsing support for object-position
https://bugs.webkit.org/show_bug.cgi?id=155065

Reviewed by Sam Weinig.

Source/WebCore:

Add parsing support for object-position. This is the first property with
CSS <position> values which does not have equivalent -x and -y shorthands,
so we can store it as a new LengthPoint type.

Per the CSS Values spec, bottom- and right-relative values are translated
into calc() expressions, which are exposed via computed style. For example,
"right 10px bottom" becomes "calc(100% - 10px) 100%". This also allows transitions
between, say, "left 10px bottom" and "right 10px bottom".

Test: fast/css/object-position/parsing-object-position.html

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
css/CSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::propertyValue):

css/CSSParser.cpp:

(WebCore::CSSParser::parseValue):

css/CSSPrimitiveValue.h:

(WebCore::CSSPrimitiveValue::isPair):

css/CSSPropertyNames.in:
css/CSSValue.h:
css/StyleBuilderConverter.h:

(WebCore::StyleBuilderConverter::convertLength):
(WebCore::StyleBuilderConverter::convertTo100PercentMinusLength):
(WebCore::StyleBuilderConverter::convertPositionComponent):
(WebCore::StyleBuilderConverter::convertObjectPosition):

platform/LengthPoint.cpp: Added.

(WebCore::operator<<):

platform/LengthPoint.h: Added.

(WebCore::LengthPoint::LengthPoint):
(WebCore::LengthPoint::operator==):
(WebCore::LengthPoint::setX):
(WebCore::LengthPoint::x):
(WebCore::LengthPoint::setY):
(WebCore::LengthPoint::y):
(WebCore::LengthPoint::blend):

rendering/style/RenderStyle.cpp:

(WebCore::RenderStyle::changeRequiresRepaint):

rendering/style/RenderStyle.h:
rendering/style/StyleRareNonInheritedData.cpp:

(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator==):

rendering/style/StyleRareNonInheritedData.h:

LayoutTests:

object-position parsing test.

fast/css/object-position/parsing-object-position-expected.txt: Added.
fast/css/object-position/parsing-object-position.html: Added.

1:35 PM Changeset in webkit [197616] by jdiggs@igalia.com

18 edits
21 adds in trunk

AX: Implement missing/different accessibility API mappings for SVG
https://bugs.webkit.org/show_bug.cgi?id=155034

Reviewed by Chris Fleizach.

Source/WebCore:

Create an AccessibilitySVGElement class for the SVG-specific mappings;
fix name and description mappings for ATK; add new AccessibilityRole
types (SVGTextRole, SVGTSpanRole, SVGTextPathRole) and map them for
ATK and AX API.

Tests: accessibility/w3c-svg-description-calculation.html

accessibility/w3c-svg-elements-not-exposed.html
accessibility/w3c-svg-name-calculation.html
accessibility/w3c-svg-presentational-role.html
accessibility/w3c-svg-roles.html

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
accessibility/AXObjectCache.cpp:

(WebCore::createFromRenderer):

accessibility/AccessibilityAllInOne.cpp:
accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::alternativeText): Deleted.
(WebCore::AccessibilityNodeObject::accessibilityDescription): Deleted.

accessibility/AccessibilityObject.h:

(WebCore::AccessibilityObject::isAccessibilitySVGElement):

accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::determineAccessibilityRole): Deleted.

accessibility/AccessibilitySVGElement.cpp: Added.

(WebCore::AccessibilitySVGElement::AccessibilitySVGElement):
(WebCore::AccessibilitySVGElement::~AccessibilitySVGElement):
(WebCore::AccessibilitySVGElement::create):
(WebCore::AccessibilitySVGElement::targetForUseElement):
(WebCore::AccessibilitySVGElement::accessibilityText):
(WebCore::AccessibilitySVGElement::accessibilityDescription):
(WebCore::AccessibilitySVGElement::helpText):
(WebCore::AccessibilitySVGElement::computeAccessibilityIsIgnored):
(WebCore::AccessibilitySVGElement::inheritsPresentationalRole):
(WebCore::AccessibilitySVGElement::determineAriaRoleAttribute):
(WebCore::AccessibilitySVGElement::determineAccessibilityRole):

accessibility/AccessibilitySVGElement.h: Added.
accessibility/atk/WebKitAccessibleWrapperAtk.cpp:

(webkitAccessibleGetName):
(webkitAccessibleGetDescription):
(atkRole):

accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(createAccessibilityRoleMap):

rendering/RenderObject.h:

(WebCore::RenderObject::isSVGTSpan):

rendering/svg/RenderSVGTSpan.h:

LayoutTests:

accessibility/svg-group-element-with-title.html: Modified to reflect correct ATK results.
accessibility/svg-image.html: Modified to reflect correct ATK results.
accessibility/svg-labelledby.html: Modified to reflect correct ATK results.
accessibility/svg-remote-element.html: Modified to reflect correct ATK results.
accessibility/w3c-svg-description-calculation.html: Added.
accessibility/w3c-svg-elements-not-exposed.html: Added.
accessibility/w3c-svg-name-calculation.html: Added.
accessibility/w3c-svg-presentational-role.html: Added.
accessibility/w3c-svg-roles.html: Added.
platform/gtk/accessibility/svg-group-element-with-title-expected.txt: Added.
platform/gtk/accessibility/svg-image-expected.txt: Added.
platform/gtk/accessibility/svg-labelledby-expected.txt: Added.
platform/gtk/accessibility/svg-remote-element-expected.txt: Added.
platform/gtk/accessibility/w3c-svg-description-calculation-expected.txt: Added.
platform/gtk/accessibility/w3c-svg-elements-not-exposed-expected.txt: Added.
platform/gtk/accessibility/w3c-svg-name-calculation-expected.txt: Added.
platform/gtk/accessibility/w3c-svg-presentational-role-expected.txt: Added.
platform/gtk/accessibility/w3c-svg-roles-expected.txt: Added.
platform/mac/accessibility/w3c-svg-description-calculation-expected.txt: Added.
platform/mac/accessibility/w3c-svg-elements-not-exposed-expected.txt: Added.
platform/mac/accessibility/w3c-svg-name-calculation-expected.txt: Added.
platform/mac/accessibility/w3c-svg-presentational-role-expected.txt: Added.
platform/mac/accessibility/w3c-svg-roles-expected.txt: Added.

11:44 AM Changeset in webkit [197615] by clopez@igalia.com

2 edits in trunk/Tools

[GTK] Fix logging details after r197505 (Run the run-benchmark script on the performance bot.)
https://bugs.webkit.org/show_bug.cgi?id=154595

Unreviewed.

Scripts/webkitpy/benchmark_runner/run_benchmark.py:

(start): Use logging.exception when a test fails in order to get the details about the error.

9:01 AM Changeset in webkit [197614] by Yusuke Suzuki

114 edits
1 add in trunk/Source

[ES6] Support Reflect.construct
https://bugs.webkit.org/show_bug.cgi?id=147330

Reviewed by Saam Barati.

Source/JavaScriptCore:

Based on Saam's r196868, this patch adds support for Reflect.construct.
This patch implements OrdinaryCreateFromConstructor[1] for fallback cases.
This path is rarely taken. For example,

Reflect.construct(function () { }, [], Map);

In this case, the new.target becomes Map.
So we should create an object that __proto__ is Map.prototype.

And to allow forward declaration (and encouraging strong type checking), we change
ConstructType, CallType to C++11 enum class.

[1]: http://ecma-international.org/ecma-262/6.0/#sec-ordinarycreatefromconstructor

API/JSCallbackConstructor.cpp:

(JSC::JSCallbackConstructor::getConstructData):

API/JSCallbackFunction.cpp:

(JSC::JSCallbackFunction::getCallData):

API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject<Parent>::getConstructData):
(JSC::JSCallbackObject<Parent>::getCallData):

API/JSObjectRef.cpp:

(JSObjectIsFunction):
(JSObjectCallAsFunction):
(JSObjectIsConstructor):
(JSObjectCallAsConstructor):

API/ObjCCallbackFunction.mm:

(JSC::ObjCCallbackFunction::getCallData):
(JSC::ObjCCallbackFunction::getConstructData):

bindings/ScriptFunctionCall.cpp:

(Deprecated::ScriptFunctionCall::call):

bindings/ScriptValue.cpp:

(Deprecated::ScriptValue::isFunction):

builtins/ReflectObject.js:
dfg/DFGOperations.cpp:
inspector/InjectedScriptManager.cpp:

(Inspector::InjectedScriptManager::createInjectedScript):

interpreter/Interpreter.cpp:

(JSC::sizeOfVarargs):
(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):
(JSC::Interpreter::executeConstruct):

jit/JITOperations.cpp:
llint/LLIntSlowPaths.cpp:

(JSC::LLInt::handleHostCall):

runtime/ArrayConstructor.cpp:

(JSC::ArrayConstructor::getConstructData):
(JSC::ArrayConstructor::getCallData):

runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncToString):
(JSC::arrayProtoFuncToLocaleString):
(JSC::getLength): Deleted.

runtime/BooleanConstructor.cpp:

(JSC::BooleanConstructor::getConstructData):
(JSC::BooleanConstructor::getCallData):

runtime/CallData.cpp:

(JSC::call):

runtime/CallData.h:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/ConstructData.cpp:

(JSC::construct):

runtime/ConstructData.h:
runtime/DateConstructor.cpp:

(JSC::DateConstructor::getConstructData):
(JSC::DateConstructor::getCallData):

runtime/DatePrototype.cpp:

(JSC::dateProtoFuncToJSON):

runtime/Error.h:

(JSC::StrictModeTypeErrorFunction::getConstructData):
(JSC::StrictModeTypeErrorFunction::getCallData):

runtime/ErrorConstructor.cpp:

(JSC::ErrorConstructor::getConstructData):
(JSC::ErrorConstructor::getCallData):

runtime/ExceptionHelpers.cpp:

(JSC::errorDescriptionForValue):

runtime/FunctionConstructor.cpp:

(JSC::FunctionConstructor::getConstructData):
(JSC::FunctionConstructor::getCallData):

runtime/FunctionPrototype.cpp:

(JSC::FunctionPrototype::getCallData):
(JSC::functionProtoFuncToString):
(JSC::functionProtoFuncBind):

runtime/GeneratorFunctionConstructor.cpp:

(JSC::GeneratorFunctionConstructor::getCallData):
(JSC::GeneratorFunctionConstructor::getConstructData):

runtime/InternalFunction.cpp:

(JSC::InternalFunction::getCallData):

runtime/IntlCollatorConstructor.cpp:

(JSC::IntlCollatorConstructor::getConstructData):
(JSC::IntlCollatorConstructor::getCallData):

runtime/IntlDateTimeFormatConstructor.cpp:

(JSC::IntlDateTimeFormatConstructor::getConstructData):
(JSC::IntlDateTimeFormatConstructor::getCallData):

runtime/IntlNumberFormatConstructor.cpp:

(JSC::IntlNumberFormatConstructor::getConstructData):
(JSC::IntlNumberFormatConstructor::getCallData):

runtime/IteratorOperations.cpp:

(JSC::iteratorNext):
(JSC::iteratorClose):

runtime/JSArray.h:

(JSC::getLength):

runtime/JSArrayBufferConstructor.cpp:

(JSC::JSArrayBufferConstructor::getConstructData):
(JSC::JSArrayBufferConstructor::getCallData):

runtime/JSBoundFunction.cpp:

(JSC::boundFunctionCall):
(JSC::boundFunctionConstruct):
(JSC::JSBoundFunction::create):

runtime/JSCJSValue.h:
runtime/JSCJSValueInlines.h:

(JSC::JSValue::isFunction):
(JSC::JSValue::isConstructor):

runtime/JSCell.cpp:

(JSC::JSCell::getCallData):
(JSC::JSCell::getConstructData):

runtime/JSFunction.cpp:

(JSC::JSFunction::getCallData):
(JSC::JSFunction::getConstructData):

runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayViewWithArguments):
(JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getConstructData):
(JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):

runtime/JSInternalPromise.cpp:

(JSC::JSInternalPromise::then):

runtime/JSInternalPromiseConstructor.cpp:

(JSC::JSInternalPromiseConstructor::getConstructData):
(JSC::JSInternalPromiseConstructor::getCallData):

runtime/JSJob.cpp:

(JSC::JSJobMicrotask::run):

runtime/JSONObject.cpp:

(JSC::Stringifier::Stringifier):
(JSC::Stringifier::toJSONImpl):
(JSC::Stringifier::appendStringifiedValue):
(JSC::JSONProtoFuncParse):

runtime/JSObject.cpp:

(JSC::callToPrimitiveFunction):
(JSC::JSObject::hasInstance):
(JSC::JSObject::getMethod):

runtime/JSObject.h:

(JSC::getCallData):
(JSC::getConstructData):

runtime/JSPromise.cpp:

(JSC::JSPromise::initialize):

runtime/JSPromiseConstructor.cpp:

(JSC::JSPromiseConstructor::getConstructData):
(JSC::JSPromiseConstructor::getCallData):

runtime/JSPromiseDeferred.cpp:

(JSC::newPromiseCapability):
(JSC::callFunction):

runtime/JSTypedArrayViewConstructor.cpp:

(JSC::constructTypedArrayView):
(JSC::JSTypedArrayViewConstructor::getConstructData):
(JSC::JSTypedArrayViewConstructor::getCallData):

runtime/MapConstructor.cpp:

(JSC::constructMap):
(JSC::MapConstructor::getConstructData):
(JSC::MapConstructor::getCallData):

runtime/ModuleLoaderObject.cpp:

(JSC::ModuleLoaderObject::provide):
(JSC::ModuleLoaderObject::loadAndEvaluateModule):
(JSC::ModuleLoaderObject::loadModule):
(JSC::ModuleLoaderObject::linkAndEvaluateModule):

runtime/NativeErrorConstructor.cpp:

(JSC::NativeErrorConstructor::getConstructData):
(JSC::NativeErrorConstructor::getCallData):

runtime/NullGetterFunction.cpp:

(JSC::NullGetterFunction::getCallData):
(JSC::NullGetterFunction::getConstructData):

runtime/NullSetterFunction.cpp:

(JSC::NullSetterFunction::getCallData):
(JSC::NullSetterFunction::getConstructData):

runtime/NumberConstructor.cpp:

(JSC::NumberConstructor::getConstructData):
(JSC::NumberConstructor::getCallData):

runtime/ObjectConstructor.cpp:

(JSC::ObjectConstructor::getConstructData):
(JSC::ObjectConstructor::getCallData):
(JSC::toPropertyDescriptor):

runtime/ObjectPrototype.cpp:

(JSC::objectProtoFuncDefineGetter):
(JSC::objectProtoFuncDefineSetter):
(JSC::objectProtoFuncToLocaleString):

runtime/Operations.cpp:

(JSC::jsTypeStringForValue):
(JSC::jsIsObjectTypeOrNull):
(JSC::jsIsFunctionType):

runtime/ProxyConstructor.cpp:

(JSC::ProxyConstructor::getConstructData):
(JSC::ProxyConstructor::getCallData):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::finishCreation):
(JSC::performProxyCall):
(JSC::ProxyObject::getCallData):
(JSC::performProxyConstruct):
(JSC::ProxyObject::getConstructData):

runtime/ReflectObject.cpp:

(JSC::reflectObjectConstruct):

runtime/RegExpConstructor.cpp:

(JSC::RegExpConstructor::getConstructData):
(JSC::RegExpConstructor::getCallData):

runtime/RuntimeType.h:
runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::processUnverifiedStackTraces):

runtime/SetConstructor.cpp:

(JSC::constructSet):
(JSC::SetConstructor::getConstructData):
(JSC::SetConstructor::getCallData):

runtime/StringConstructor.cpp:

(JSC::StringConstructor::getConstructData):
(JSC::StringConstructor::getCallData):

runtime/StringPrototype.cpp:

(JSC::replaceUsingRegExpSearch):
(JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
(JSC::operationStringProtoFuncReplaceRegExpString):
(JSC::replaceUsingStringSearch):

runtime/SymbolConstructor.cpp:

(JSC::SymbolConstructor::getConstructData):
(JSC::SymbolConstructor::getCallData):

runtime/WeakMapConstructor.cpp:

(JSC::constructWeakMap):
(JSC::WeakMapConstructor::getConstructData):
(JSC::WeakMapConstructor::getCallData):

runtime/WeakSetConstructor.cpp:

(JSC::constructWeakSet):
(JSC::WeakSetConstructor::getConstructData):
(JSC::WeakSetConstructor::getCallData):

tests/es6.yaml:
tests/stress/reflect-construct.js: Added.

(shouldBe):
(shouldThrow):
(shouldThrow.array.get length):
(shouldThrow.array.get 0):
(array.get length):
(array.get 0):
(shouldBe.Reflect.construct):
(shouldBe.Reflect.construct.Hello):
(3.shouldBe.Reflect.construct.Hello):
(3.newTarget):
(0.shouldBe.Reflect.construct):
(shouldBe.A):
(shouldBe.B):
(nativeConstructorTest.DerivedMap):
(nativeConstructorTest.FailedMap):
(set noInline):

Source/WebCore:

Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::installReplacement):

bindings/js/CallbackFunction.cpp:

(WebCore::checkFunctionOnlyCallback):

bindings/js/JSCallbackData.cpp:

(WebCore::JSCallbackData::invokeCallback):

bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::constructElement):
(WebCore::JSCustomElementInterface::attributeChanged):

bindings/js/JSCustomXPathNSResolver.cpp:

(WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):

bindings/js/JSDOMBinding.cpp:

(WebCore::callFunctionWithCurrentArguments):
(WebCore::DOMConstructorObject::getCallData):

bindings/js/JSDOMConstructor.h:

(WebCore::JSDOMConstructorNotConstructable::getCallData):
(WebCore::JSDOMConstructor<JSClass>::getConstructData):
(WebCore::JSDOMNamedConstructor<JSClass>::getConstructData):
(WebCore::JSBuiltinConstructor<JSClass>::getConstructData):

bindings/js/JSDOMPromise.cpp:

(WebCore::DeferredWrapper::callFunction):

bindings/js/JSDocumentCustom.cpp:

(WebCore::JSDocument::defineElement):

bindings/js/JSErrorHandler.cpp:

(WebCore::JSErrorHandler::handleEvent):

bindings/js/JSEventListener.cpp:

(WebCore::JSEventListener::handleEvent):

bindings/js/JSHTMLAllCollectionCustom.cpp:

(WebCore::JSHTMLAllCollection::getCallData):

bindings/js/JSHTMLDocumentCustom.cpp:

(WebCore::JSHTMLDocument::open):

bindings/js/JSKeyValueIterator.h:

(WebCore::keyValueIteratorForEach):

bindings/js/JSMainThreadExecStateInstrumentation.h:

(WebCore::JSMainThreadExecState::instrumentFunctionCall):
(WebCore::JSMainThreadExecState::instrumentFunctionConstruct):

bindings/js/JSMutationCallback.cpp:

(WebCore::JSMutationCallback::call):

bindings/js/JSMutationObserverCustom.cpp:

(WebCore::constructJSMutationObserver):

bindings/js/JSPluginElementFunctions.cpp:

(WebCore::callPlugin):
(WebCore::pluginElementGetCallData):

bindings/js/ScheduledAction.cpp:

(WebCore::ScheduledAction::create):
(WebCore::ScheduledAction::executeFunctionInContext):

bindings/objc/WebScriptObject.mm:

(-[WebScriptObject callWebScriptMethod:withArguments:]):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateConstructorHelperMethods):

bindings/scripts/test/JS/JSFloat64Array.cpp:

(WebCore::JSFloat64ArrayConstructor::getConstructData):

bindings/scripts/test/JS/JSTestInterface.cpp:

(WebCore::JSTestInterfaceConstructor::getConstructData):

bridge/NP_jsobject.cpp:

(_NPN_InvokeDefault):
(_NPN_Invoke):
(_NPN_Construct):

bridge/objc/objc_runtime.mm:

(JSC::Bindings::ObjcFallbackObjectImp::getCallData):

bridge/runtime_method.cpp:

(JSC::RuntimeMethod::getCallData):

bridge/runtime_object.cpp:

(JSC::Bindings::RuntimeObject::getCallData):
(JSC::Bindings::RuntimeObject::getConstructData):

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::updateCaptionContainer):
(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
(WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):

html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):

testing/Internals.cpp:

(WebCore::Internals::isReadableStreamDisturbed):

Source/WebKit/mac:

Plugins/Hosted/NetscapePluginInstanceProxy.mm:

(WebKit::NetscapePluginInstanceProxy::invoke):
(WebKit::NetscapePluginInstanceProxy::invokeDefault):
(WebKit::NetscapePluginInstanceProxy::construct):

Source/WebKit/win:

Plugins/PluginPackage.cpp:

(WebCore::NPN_Invoke):

Source/WebKit2:

WebProcess/Plugins/Netscape/JSNPMethod.cpp:

(WebKit::JSNPMethod::getCallData):

WebProcess/Plugins/Netscape/JSNPObject.cpp:

(WebKit::JSNPObject::getCallData):
(WebKit::JSNPObject::getConstructData):

WebProcess/Plugins/Netscape/NPJSObject.cpp:

(WebKit::NPJSObject::hasMethod):
(WebKit::NPJSObject::construct):
(WebKit::NPJSObject::invoke):

12:50 AM Changeset in webkit [197613] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

Fix the bindings test after r197611.

bindings/scripts/test/TestObj.idl:

12:31 AM Changeset in webkit [197612] by rniwa@webkit.org

7 edits in trunk/Source/WebCore

Move QualifiedName from CustomElementInfo to JSCustomElementInterface
https://bugs.webkit.org/show_bug.cgi?id=155061

Reviewed by Antti Koivisto.

Store QualifiedName of custom elements in JSCustomElementInterface instead of CustomElementInfo
now that each interface is associated with exactly one custom element as of r197602.

No new tests since this is a refactoring.

bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::JSCustomElementInterface): Now takes QualifiedName as the
first argument.

bindings/js/JSCustomElementInterface.h:

(WebCore::JSCustomElementInterface::create):
(WebCore::JSCustomElementInterface::name): Added.

bindings/js/JSDocumentCustom.cpp:

(WebCore::JSDocument::defineElement):

bindings/js/JSHTMLElementCustom.cpp:

(WebCore::constructJSHTMLElement): Use findInterface instead of the deleted findName.

dom/CustomElementDefinitions.cpp:

(WebCore::CustomElementDefinitions::checkName):
(WebCore::CustomElementDefinitions::addElementDefinition): Renamed from defineElement.
(WebCore::CustomElementDefinitions::findInterface): Add a variant that finds the interface object
by a JS constructor.
(WebCore::CustomElementDefinitions::containsConstructor):
(WebCore::CustomElementDefinitions::findName): Deleted.

dom/CustomElementDefinitions.h:

(WebCore::CustomElementDefinitions::CustomElementInfo::CustomElementInfo): Deleted.

Mar 4, 2016:

11:50 PM Changeset in webkit [197611] by rniwa@webkit.org

14 edits
6 adds in trunk

Add basic support for attributeChanged lifecycle callback
https://bugs.webkit.org/show_bug.cgi?id=155011

Reviewed by Antti Koivisto.

Source/WebCore:

Add basic support for attributeChangedCallback in setAttribute, removeAttribute, setAttributeNS,
remoteAttributeNS, setAttributeNode, and removeAttributeNS. There are many other DOM APIs that
could modify attributes but we would annotate those APIs in a separate patch to limit the scope
of this change.

In order to invoke the lifecycle callback right before returning to the author script, allocate
an instance of CustomElementLifecycleProcessingStack in each of these functions' binding code.
The stack object's destructor invokes all callbacks enqueued by the DOM API if there are any.

Spec: https://w3c.github.io/webcomponents/spec/custom/#dfn-attribute-changed-callback

Tests: fast/custom-elements/attribute-changed-callback.html

fast/custom-elements/lifecycle-callback-timing.html

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::attributeChanged): Added. Invokes attributeChangedCallback.

bindings/js/JSCustomElementInterface.h:
bindings/js/JSMainThreadExecState.h:

(JSMainThreadNullState): Allocate an instance of CustomElementLifecycleProcessingStack in GObject
and Objective-C binding code for consistency with JavaScript. We can't do this in JavaScript
because there is no RAII object all functions, getters, and setters allocate (for a good reason).

bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation): Generate an instance of CustomElementLifecycleProcessingStack when
NeedsLifecycleProcessingStack is specified as an extended IDL attribute.

bindings/scripts/IDLAttributes.txt: Added NeedsLifecycleProcessingStack.
bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjPrototypeFunctionMethodWithNeedsLifecycleProcessingStack):

bindings/scripts/test/TestObj.idl: Added a test for NeedsLifecycleProcessingStack.

dom/DOMAllInOne.cpp:
dom/Element.cpp:

(WebCore::Element::attributeChanged): Enqueue attributeChanged callback if the context object
is a custom element and there is a CustomElementLifecycleProcessingStack allocated in the stack.

dom/Element.idl:

dom/LifecycleCallbackQueue.cpp: Added.

(WebCore::LifecycleQueueItem): Added.
(WebCore::LifecycleQueueItem::LifecycleQueueItem): Added.
(WebCore::LifecycleQueueItem::invoke): Added.
(WebCore::LifecycleCallbackQueue::LifecycleCallbackQueue): Added.
(WebCore::LifecycleCallbackQueue::~LifecycleCallbackQueue): Added.
(WebCore::LifecycleCallbackQueue::enqueueAttributeChangedCallback): Added.
(WebCore::LifecycleCallbackQueue::invokeAll): Added.
(WebCore::CustomElementLifecycleProcessingStack::ensureCurrentQueue): Added. As noted in FIXME,
the early exit in the code is necessary only because we haven't added NeedsLifecycleProcessingStack
in all places. It should go away in a follow up patch.
(WebCore::CustomElementLifecycleProcessingStack::processQueue): Added.

dom/LifecycleCallbackQueue.h: Added.

(WebCore::CustomElementLifecycleProcessingStack): This is a light weight RAII object the binding
code will allocate in order to queue up lifecycle callbacks. We don't use Ref or std::unique_ptr
in m_queue to avoid generating the code to destruct LifecycleCallbackQueue everywhere.
(WebCore::CustomElementLifecycleProcessingStack::CustomElementLifecycleProcessingStack): Added.
(WebCore::CustomElementLifecycleProcessingStack::~CustomElementLifecycleProcessingStack): Added.
(WebCore::CustomElementLifecycleProcessingStack::hasCurrentProcessingStack): Added.

LayoutTests:

Added a test for attributeChangedCallback and a test for the timing of lifecycle callbacks in general.

fast/custom-elements/attribute-changed-callback-expected.txt: Added.
fast/custom-elements/attribute-changed-callback.html: Added.
fast/custom-elements/lifecycle-callback-timing-expected.txt: Added.
fast/custom-elements/lifecycle-callback-timing.html: Added.

11:31 PM Changeset in webkit [197610] by timothy_horton@apple.com

2 edits in trunk/LayoutTests

Temporarily skip attachment tests on iOS

platform/ios-simulator/TestExpectations:

There's no point in running these quite yet (I'm surprised they weren't already skipped).
We'll turn them back on soon.

10:25 PM Changeset in webkit [197609] by Carlos Garcia Campos

3 edits in trunk/Source/WebCore

[GTK] Scrollbars are broken again with GTK+ >= 3.19.11
https://bugs.webkit.org/show_bug.cgi?id=154890

Reviewed by Michael Catanzaro.

Scrollbar style properties have been deprecated in GTK+, and it
seems that now deprecating means keeping the properties but
ignoring them. So, this reworks the whole scrollbars theme code
again to not cache style properties anymore, but retrieve them
from the GtkStyleContext. Previous GTK+ versions still need to
query the style properties, so I've added helper functions to get
all the style properties with the ifdefs, trying to keep the
common render code free of GTK+ versions ifdefs.

platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::backButtonRect):
(WebCore::ScrollbarThemeGtk::forwardButtonRect):
(WebCore::ScrollbarThemeGtk::trackRect):
(WebCore::ScrollbarThemeGtk::thumbRect):
(WebCore::ScrollbarThemeGtk::paintTrackBackground):
(WebCore::ScrollbarThemeGtk::paintThumb):
(WebCore::ScrollbarThemeGtk::paint):
(WebCore::ScrollbarThemeGtk::scrollbarThickness):
(WebCore::ScrollbarThemeGtk::buttonSize):
(WebCore::ScrollbarThemeGtk::stepperSize):
(WebCore::ScrollbarThemeGtk::getStepperSpacing):
(WebCore::ScrollbarThemeGtk::troughUnderSteppers):
(WebCore::ScrollbarThemeGtk::minimumThumbLength):
(WebCore::ScrollbarThemeGtk::thumbFatness):
(WebCore::ScrollbarThemeGtk::getTroughBorder):
(WebCore::ScrollbarThemeGtk::getOrCreateStyleContext):
(WebCore::ScrollbarThemeGtk::updateThemeProperties):
(WebCore::ScrollbarThemeGtk::handleMousePressEvent):

platform/gtk/ScrollbarThemeGtk.h:

9:24 PM Changeset in webkit [197608] by Brent Fulgham

5 edits in trunk/Source/WebCore

Resource load statistics are not honoring private browsing
https://bugs.webkit.org/show_bug.cgi?id=155054
<rdar://problem/24987873>

Reviewed by Andy Estes.

Modify the points where we capture resource load statistics to ignore
loads made during private browsing. Do this by moving more of the logic
about whether to gather statistics into the logging functions, passing
the raw input types (frame, ResourceRequest, ResourceResponse) internally
so that we don't pay any cost until we decide we want to gather data.s

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::willSendRequest): Revise for the new API on
ResourceLoadObserver.

loader/ResourceLoadObserver.cpp:

(WebCore::ResourceLoadObserver::logFrameNavigation): Revise signature and
check for private browsing.
(WebCore::ResourceLoadObserver::logSubresourceLoading): Ditto.
(WebCore::ResourceLoadObserver::logUserInteraction): Ditto.

loader/ResourceLoadObserver.h:
loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::willSendRequestInternal): Ditto.

7:42 PM Changeset in webkit [197607] by Lucas Forschler

1 edit in trunk/Tools/BuildSlaveSupport/build.webkit.org-config/config.json

config.json fix to remove duplicate scheduler.

7:30 PM Changeset in webkit [197606] by commit-queue@webkit.org

5 edits in trunk/Source

Fix file mime-types when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=155058

Patch by Alex Christensen <achristensen@webkit.org> on 2016-03-04
Reviewed by Andy Estes.

Source/WebCore:

This fixes platform/mac/fast/loader/file-url-mimetypes-3.html
and platform/mac/fast/loader/file-url-mimetypes.html.

platform/network/mac/WebCoreURLResponse.h:

Source/WebKit2:

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::NetworkDataTask):
Call adjustMIMETypeIfNecessary like we do in connection didReceiveResponse in
WebCoreResourceHandleAsOperationQueueDelegate.mm.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
Don't content sniff file urls. This check is analogous to ResourceHandle::shouldContentSniffURL.

5:35 PM Changeset in webkit [197605] by weinig@apple.com

10 edits in trunk/Source

[WebKit2] Add WebKit2 equivalent of -[WebView _insertNewlineInQuotedContent]
<rdar://problem/24943591>
https://bugs.webkit.org/show_bug.cgi?id=155057

Reviewed by Tim Horton.

Source/WebCore:

Move Editor::insertParagraphSeparatorInQuotedContent() into Editor.cpp
and remove the duplicated code in EditorIOS.mm and EditorMac.mm.

editing/Editor.cpp:

(WebCore::Editor::insertParagraphSeparatorInQuotedContent):

editing/Editor.h:
editing/ios/EditorIOS.mm:

(WebCore::Editor::insertParagraphSeparatorInQuotedContent): Deleted.

editing/mac/EditorMac.mm:

(WebCore::Editor::insertParagraphSeparatorInQuotedContent): Deleted.

Source/WebKit2:

WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:

(WKBundlePageInsertNewlineInQuotedContent):

WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::insertNewlineInQuotedContent):

WebProcess/WebPage/WebPage.h:

Expose WKBundlePageInsertNewlineInQuotedContent as SPI.

5:34 PM Changeset in webkit [197604] by barraclough@apple.com

2 edits in trunk/Source/WebCore

Convert DOMTimer interval from int to std::chromo::milliseconds
https://bugs.webkit.org/show_bug.cgi?id=155051

Speculative build fix.

inspector/TimelineRecordFactory.cpp:

(WebCore::TimelineRecordFactory::createTimerInstallData):

5:32 PM Changeset in webkit [197603] by barraclough@apple.com

2 edits in trunk/Source/WebCore

Convert DOMTimer interval from int to std::chromo::milliseconds
https://bugs.webkit.org/show_bug.cgi?id=155051

iOS build fix

page/DOMTimer.cpp:

(WebCore::DOMTimer::install):

5:23 PM Changeset in webkit [197602] by rniwa@webkit.org

18 edits
2 moves in trunk

Update defineCustomElement according to the spec rewrite
https://bugs.webkit.org/show_bug.cgi?id=155010
<rdar://problem/24970878>

Reviewed by Chris Dumez.

Source/WebCore:

Updated the implementation of defineCustomElement and HTMLConstructor per recent rewrite of the spec:
https://w3c.github.io/webcomponents/spec/custom/#dom-document-defineelement
https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor

defineCustomElement is now called defineElement and we disallow defining multiple custom elements with
a single class and throw an exception in defineElement.

Test: fast/custom-elements/Document-defineElement.html

bindings/js/JSDocumentCustom.cpp:

(WebCore::JSDocument::defineElement): Renamed from defineCustomElement. Throw an exception when the interface
already defines another custom element. Also added FIXME's for missing steps.

bindings/js/JSHTMLElementCustom.cpp:

(WebCore::constructJSHTMLElement): Removed the support for specifying a tag name in the first argument when
a single class defines multiple custom elements since that now results in an exception (in defineElement).

dom/CustomElementDefinitions.cpp:

(WebCore::CustomElementDefinitions::containsConstructor): Added.

dom/CustomElementDefinitions.h:
dom/Document.idl: Renamed defineCustomElement to defineElement.
html/HTMLElement.idl: Removed the optional tag name from the constructor.

LayoutTests:

Update the tests for the rename and semantics change of defineCustomElement and HTMLElement constructor.

fast/custom-elements/Document-createElement.html:
fast/custom-elements/Document-defineCustomElement-expected.txt: Removed.
fast/custom-elements/Document-defineCustomElement.html: Removed.
fast/custom-elements/Document-defineElement-expected.txt: Renamed from LayoutTests/fast/custom-elements/Document-defineCustomElement-expected.txt.
fast/custom-elements/Document-defineElement.html: Renamed from LayoutTests/fast/custom-elements/Document-defineCustomElement.html.

Also added a test case for defining multiple custom elements with a single class, which must throw.

fast/custom-elements/HTMLElement-constructor-expected.txt:
fast/custom-elements/HTMLElement-constructor.html:

Removed test cases for the tag name in the first argument as well as ones that associate a single class with multiple tag names.

fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html:
fast/custom-elements/parser/parser-constructs-custom-element-synchronously.html:
fast/custom-elements/parser/parser-constructs-custom-elements.html:
fast/custom-elements/parser/parser-fallsback-to-unknown-element.html:
fast/custom-elements/parser/parser-sets-attributes-and-children.html:
fast/custom-elements/parser/parser-uses-constructed-element.html:
fast/custom-elements/parser/parser-uses-registry-of-owner-document.html:

5:06 PM Changeset in webkit [197601] by ap@apple.com

2 edits in trunk/Tools

Add iOS simulator debug bots
https://bugs.webkit.org/show_bug.cgi?id=155053

Reviewed by Lucas Forschler.

BuildSlaveSupport/build.webkit.org-config/config.json:

4:57 PM Changeset in webkit [197600] by timothy_horton@apple.com

3 edits in trunk/Source/WebCore

Begin implementing <attachment> painting on iOS
https://bugs.webkit.org/show_bug.cgi?id=155046
<rdar://problem/24805991>

Reviewed by Enrica Casucci.

No new tests; there are existing tests that I will unskip and rebaseline
in the near future.

rendering/RenderThemeIOS.h:
rendering/RenderThemeIOS.mm:

(WebCore::AttachmentInfo::addLine):
(WebCore::AttachmentInfo::buildTitleLines):
(WebCore::AttachmentInfo::buildSingleLine):
(WebCore::getAttachmentProgress):
(WebCore::iconForAttachment):
(WebCore::AttachmentInfo::AttachmentInfo):
(WebCore::RenderThemeIOS::attachmentIntrinsicSize):
(WebCore::RenderThemeIOS::attachmentBaseline):
(WebCore::paintAttachmentIcon):
(WebCore::paintAttachmentText):
(WebCore::paintAttachmentProgress):
(WebCore::paintAttachmentBorder):
(WebCore::RenderThemeIOS::paintAttachment):
There are still a few missing pieces, but get <attachment> painting a bit on iOS.
We will paint an icon, action, title, and subtitle - in that order - depending on what we have.
The content is vertically and horizontally centered.

4:56 PM Changeset in webkit [197599] by barraclough@apple.com

11 edits in trunk/Source/WebCore

Convert DOMTimer interval from int to std::chromo::milliseconds
https://bugs.webkit.org/show_bug.cgi?id=155051

Reviewed by Ryosuke Niwa.

This change is pretty much mechanical, replacing int with std::chrono::milliseconds.

inspector/InspectorInstrumentation.cpp:

(WebCore::InspectorInstrumentation::willSendXMLHttpRequestImpl):
(WebCore::InspectorInstrumentation::didInstallTimerImpl):

inspector/InspectorInstrumentation.h:

(WebCore::InspectorInstrumentation::willSendXMLHttpRequest):
(WebCore::InspectorInstrumentation::didInstallTimer):

inspector/InspectorTimelineAgent.cpp:

(WebCore::InspectorTimelineAgent::didPaint):
(WebCore::InspectorTimelineAgent::didInstallTimer):

inspector/InspectorTimelineAgent.h:
inspector/TimelineRecordFactory.cpp:

(WebCore::TimelineRecordFactory::createGenericTimerData):
(WebCore::TimelineRecordFactory::createTimerInstallData):

inspector/TimelineRecordFactory.h:
page/DOMTimer.cpp:

(WebCore::shouldForwardUserGesture):
(WebCore::DOMTimer::DOMTimer):
(WebCore::DOMTimer::~DOMTimer):
(WebCore::DOMTimer::install):
(WebCore::DOMTimer::intervalClampedToMinimum):

page/DOMTimer.h:
page/DOMWindow.cpp:

(WebCore::DOMWindow::setTimeout):
(WebCore::DOMWindow::clearTimeout):
(WebCore::DOMWindow::setInterval):
(WebCore::DOMWindow::clearInterval):

workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::setTimeout):
(WebCore::WorkerGlobalScope::clearTimeout):
(WebCore::WorkerGlobalScope::setInterval):
(WebCore::WorkerGlobalScope::clearInterval):

4:40 PM Changeset in webkit [197598] by Brent Fulgham

5 edits in trunk/Source/WebKit2

Stub API to support a debug menu option for measuring resource load statistics
https://bugs.webkit.org/show_bug.cgi?id=154998
<rdar://problem/24944604>

Reviewed by Andy Estes.

UIProcess/API/APIWebsiteDataStore.cpp:

(API::WebsiteDataStore::resourceLoadStatisticsEnabled): Added stub.
(API::WebsiteDataStore::setResourceLoadStatisticsEnabled): Ditto.

UIProcess/API/APIWebsiteDataStore.h:
UIProcess/API/C/WKWebsiteDataStoreRef.cpp:

(WKWebsiteDataStoreSetResourceLoadStatisticsEnabled): Added method that calls through
to the underlying APIWebsiteDataStore class.
(WKWebsiteDataStoreGetResourceLoadStatisticsEnabled): Ditto.

UIProcess/API/C/WKWebsiteDataStoreRef.h:

4:36 PM Changeset in webkit [197597] by Brent Fulgham

2 edits in trunk/Source/WebKit/mac

Unreviewed test fix for null global WebResourceLoadStatisticsStore.

WebView/WebView.mm:

(-[WebView _preferencesChanged:]):
(+[WebView _applicationWillTerminate]):

3:55 PM Changeset in webkit [197596] by enrica@apple.com

12 edits in trunk/Source

Add a mechanism to customize the long press action.
https://bugs.webkit.org/show_bug.cgi?id=154995
rdar://problem/24823732

Reviewed by Tim Horton.

Source/WebCore:

We want to allow long press on attachment elements as well.

WebCore.xcodeproj/project.pbxproj: Making HTMLAttachmentElement.h private.
html/HTMLAttachmentElement.h: Adding exported functions.

Source/WebKit2:

Adding a new private delegate method to allow clients to
replace the action sheet displayed for images and links.
The change also adds support for attachment elements.

Shared/ios/InteractionInformationAtPosition.h:
Shared/ios/InteractionInformationAtPosition.mm:

(WebKit::InteractionInformationAtPosition::encode):
(WebKit::InteractionInformationAtPosition::decode):

UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
UIProcess/API/Cocoa/_WKActivatedElementInfo.h:
UIProcess/ios/WKActionSheetAssistant.h:
UIProcess/ios/WKActionSheetAssistant.mm:

(-[WKActionSheetAssistant showImageSheet]):
(-[WKActionSheetAssistant showLinkSheet]):

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _showImageSheet]):
(-[WKContentView _showAttachmentSheet]):
(-[WKContentView _showLinkSheet]):
(-[WKContentView _actionForLongPress]):
(-[WKContentView actionSheetAssistant:shouldIncludeAppLinkActionsForElement:]):
(-[WKContentView actionSheetAssistant:showCustomSheetForElement:]):
(-[WKContentView actionSheetAssistant:decideActionsForElement:defaultActions:]):

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::getPositionInformation):

3:33 PM Changeset in webkit [197595] by akling@apple.com

7 edits in trunk/Source

[iOS] Throw away compiled RegExp code when navigating to a new page.
<https://webkit.org/b/155015>

Reviewed by Anders Carlsson.

Source/JavaScriptCore:

Add a mechanism to have the VM discard all RegExp bytecode and JIT code.

runtime/VM.cpp:

(JSC::VM::deleteAllRegExpCode):

runtime/VM.h:

Source/WebCore:

Discard RegExp code when doing a top-level navigation.
This frees up a couple hundred kilobytes on many pages.

bindings/js/GCController.cpp:

(WebCore::GCController::deleteAllRegExpCode):

bindings/js/GCController.h:
loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad):

3:32 PM Changeset in webkit [197594] by Simon Fraser

26 edits in trunk

Use larger tiles when possible to reduce per-tile painting overhead
https://bugs.webkit.org/show_bug.cgi?id=154985

Reviewed by Zalan Bujtas.

Source/WebCore:

r197541 inadvertently missed FrameView changes that push scrollability data
onto the TiledBacking, so didn't actually change behavior (hence the 512x512 tiles
in the failing tests).

Also remove m_tileSizeAtLastRevalidate from TileGrid; it's replaced by a simpler test.

page/FrameView.cpp:

(WebCore::FrameView::addedOrRemovedScrollbar):

platform/graphics/ca/TileGrid.cpp:

(WebCore::TileGrid::revalidateTiles):
(WebCore::TileGrid::TileGrid): Deleted.

platform/graphics/ca/TileGrid.h:

LayoutTests:

tiled-drawing/background-transparency-toggle-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-iframe-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-iframe-with-handler-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-mainframe-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-mainframe-with-handler-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-background-no-image-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-body-layer-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-opacity-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-positioned-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-html-background-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-non-propagated-body-background-expected.txt:
tiled-drawing/scrolling/fixed/four-bars-zoomed-expected.txt:
tiled-drawing/tile-coverage-after-scroll-expected.txt:
tiled-drawing/tile-coverage-after-scroll-speculative-expected.txt:
tiled-drawing/tile-coverage-scroll-to-bottom-expected.txt:
tiled-drawing/tile-coverage-slow-scrolling-expected.txt:
tiled-drawing/tile-coverage-speculative-expected.txt:
tiled-drawing/tile-size-unscrollable-expected.txt:
tiled-drawing/tile-size-vertically-scrollable-expected.txt:
tiled-drawing/visible-rect-content-inset-expected.txt:

3:32 PM Changeset in webkit [197593] by Simon Fraser

4 edits
1 delete in trunk/Source/WebCore

Use BoxExtent instead of EdgeSet in TileController
https://bugs.webkit.org/show_bug.cgi?id=155040

Reviewed by Zalan Bujtas.

Remove EdgeSet, which was very similar to the existing BoxExtent, and use BoxExtent
in TileController.

WebCore.xcodeproj/project.pbxproj:
platform/graphics/EdgeSet.h: Removed.

(WebCore::EdgeSet::EdgeSet): Deleted.
(WebCore::EdgeSet::top): Deleted.
(WebCore::EdgeSet::setTop): Deleted.
(WebCore::EdgeSet::right): Deleted.
(WebCore::EdgeSet::setRight): Deleted.
(WebCore::EdgeSet::bottom): Deleted.
(WebCore::EdgeSet::setBottom): Deleted.
(WebCore::EdgeSet::left): Deleted.
(WebCore::EdgeSet::setLeft): Deleted.
(WebCore::EdgeSet::operator==): Deleted.
(WebCore::EdgeSet::operator!=): Deleted.

platform/graphics/ca/TileController.cpp:

(WebCore::TileController::setHasMargins):

platform/graphics/ca/TileController.h:

3:29 PM Changeset in webkit [197592] by Brent Fulgham

43 edits
5 adds in trunk

[WK2] Gather resource load statistics
https://bugs.webkit.org/show_bug.cgi?id=154278
<rdar://problem/24702892>

Reviewed by Andy Estes.

Source/WebCore:

Tested (now under WK2) by http/tests/navigation/statistics.html

Split part of the ResourceLoadObserver into a new class (ResourceLoadStatisticsStore)
that manages the collection of ResourceLoadStatistic objects, and that can be used
in the UIProcess without touching various WebProcess-specific WebCore classes.

Have the WebProcess only fire a message to the UIProcess if data has been modified. Otherwise,
no messages should be sent. When new data is encountered, start a 5 second timer. If more
data is found during this delay, just accumulate it. When the timer fires, all data is sent
and the timer stops until a new batch of data arrives.

CMakeLists.txt: Add the new ResourceLoadStatisticsStore class.
WebCore.xcodeproj/project.pbxproj: Adjust visibility of ResourceLoadStatistics header,

and add new ResourceLoadStatisticsStore class.

loader/ResourceLoadObserver.cpp:

(WebCore::ResourceLoadObserver::setResourceLoadStatisticsEnabled): Deleted.
(WebCore::ResourceLoadObserver::resourceLoadStatisticsEnabled): Deleted.
(WebCore::ResourceLoadObserver::setStatisticsStore): Added.
(WebCore::ResourceLoadObserver::logFrameNavigation): Tell the ResourceLoadStatisticsStore to fire its 'data changed'
handler if necessary.
(WebCore::ResourceLoadObserver::logSubresourceLoading): Ditto.
(WebCore::ResourceLoadObserver::logUserInteraction): Ditto.
(WebCore::ResourceLoadObserver::statisticsForOrigin): Use new ResourceLoadStatisticsStore.
(WebCore::ResourceLoadObserver::isPrevalentResource): Deleted.
(WebCore::ResourceLoadObserver::resourceStatisticsForPrimaryDomain): Deleted.
(WebCore::ResourceLoadObserver::writeDataToDisk): Deleted.
(WebCore::ResourceLoadObserver::setStatisticsStorageDirectory): Deleted.
(WebCore::ResourceLoadObserver::persistentStoragePath): Deleted.
(WebCore::ResourceLoadObserver::readDataFromDiskIfNeeded): Deleted.
(WebCore::ResourceLoadObserver::createDecoderFromDisk): Deleted.
(WebCore::ResourceLoadObserver::writeEncoderToDisk): Deleted.

loader/ResourceLoadObserver.h:
loader/ResourceLoadStatistics.cpp:

(WebCore::ResourceLoadStatistics::encode): Get rid of unneeded argument.
(WebCore::ResourceLoadStatistics::decode): Ditto.
(WebCore::mergeHashCountedSet): Added helper function.
(WebCore::ResourceLoadStatistics::merge): Added.

loader/ResourceLoadStatistics.h:

(WebCore::ResourceLoadStatistics::ResourceLoadStatistics):

loader/ResourceLoadStatisticsStore.cpp: Added.

(WebCore::ResourceLoadStatisticsStore::create):
(WebCore::ResourceLoadStatisticsStore::ResourceLoadStatisticsStore):
(WebCore::ResourceLoadStatisticsStore::isPrevalentResource):
(WebCore::ResourceLoadStatisticsStore::resourceStatisticsForPrimaryDomain):
(WebCore::ResourceLoadStatisticsStore::writeDataToDisk):
(WebCore::ResourceLoadStatisticsStore::setStatisticsStorageDirectory):
(WebCore::ResourceLoadStatisticsStore::persistentStoragePath):
(WebCore::ResourceLoadStatisticsStore::readDataFromDiskIfNeeded):
(WebCore::ResourceLoadStatisticsStore::createDecoderFromDisk):
(WebCore::ResourceLoadStatisticsStore::writeEncoderToDisk):
(WebCore::ResourceLoadStatisticsStore::statisticsForOrigin):
(WebCore::ResourceLoadStatisticsStore::takeStatistics):
(WebCore::ResourceLoadStatisticsStore::mergeStatistics):
(WebCore::ResourceLoadStatisticsStore::setNotificationCallback):
(WebCore::ResourceLoadStatisticsStore::fireDataModificationHandler):

loader/ResourceLoadStatisticsStore.h: Added.

Source/WebKit/mac:

Switch to maintaining a global WebCore::ResourceLoadStatisticsStore in the WebKit process,
and hand it off to the WebCore layer to use during data gathering. The ResourceLoadStatisticsStore
is now responsible for reading/writing to disk, and tracking the collection of load data.

WebView/WebView.mm:

(WebKitInitializeApplicationStatisticsStoragePathIfNecessary): Initialize singleton
ResourceLoadStatisticsStore object for tracking state.
(-[WebView _preferencesChanged:]): Revise for new singleton.
(+[WebView _applicationWillTerminate]): Ditto.

Source/WebKit2:

Revise the WebProcess to notify the UIProcess about resource load statistics. These
updates are not time-critical, and do not need to be done in concert with the actual
load. As resource loads are made, each WebProcess notifies the UIProcess of the new
load counts, then clears its local state. These statistics are then aggregated in
the UIProcess.

CMakeLists.txt: Add new ResourceLoadStatisticsState files to build.
DerivedSources.make: Ditto.
Platform/IPC/ArgumentCoders.h: Update to support HashCountedSets.
PlatformEfl.cmake: Add new ResourceLoadStatisticsState files to build.
PlatformGTK.cmake: Ditto.
PlatformMac.cmake: Ditto.
Shared/API/APIObject.h: Add new ResourceLoadStatistics type.
Shared/WebCoreArgumentCoders.cpp:

(IPC::ArgumentCoder<ExceptionDetails>::decode): Support new ResourceLoadStatistics type.
(IPC::ArgumentCoder<ResourceLoadStatistics>::encode): Added.
(IPC::ArgumentCoder<ResourceLoadStatistics>::decode): Added.

Shared/WebCoreArgumentCoders.h:
Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::encode): Handle 'resourceLoadStatisticsEnabled' flag.
(WebKit::WebProcessCreationParameters::decode): Ditto.

Shared/WebProcessCreationParameters.h:
UIProcess/API/APIProcessPoolConfiguration.cpp:

(API::ProcessPoolConfiguration::ProcessPoolConfiguration): Add storage location for the
resource load statistics.
(API::ProcessPoolConfiguration::copy): Handle the new storage location and the feature flag.

UIProcess/API/APIProcessPoolConfiguration.h:
UIProcess/API/APIWebsiteDataStore.cpp:

(API::WebsiteDataStore::defaultResourceLoadStatisticsDirectory): Added stub.

UIProcess/API/APIWebsiteDataStore.h:
UIProcess/API/Cocoa/APIWebsiteDataStoreCocoa.mm:

(API::WebsiteDataStore::defaultResourceLoadStatisticsDirectory): Added.
(API::WebsiteDataStore::defaultDataStoreConfiguration): Added support for the new resource
load statistics storage location.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]): Sync Process Pool configuration parameters
with the state of our websiteData object's "ResourceLoadStatisticsEnabled" flag, so that
new processes are created in the right state.

UIProcess/API/Cocoa/WKWebsiteDataStore.mm:

(-[WKWebsiteDataStore _resourceLoadStatisticsEnabled]): Added.
(-[WKWebsiteDataStore _setResourceLoadStatisticsEnabled:]): Added.

UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::createNewWebProcess): Handle new flag for enabling resource
load statistics.

UIProcess/WebResourceLoadStatisticsStore.cpp: Added.

(WebKit::WebResourceLoadStatisticsStore::create):
(WebKit::WebResourceLoadStatisticsStore::WebResourceLoadStatisticsStore):
(WebKit::WebResourceLoadStatisticsStore::~WebResourceLoadStatisticsStore):
(WebKit::WebResourceLoadStatisticsStore::resourceLoadStatisticsUpdated):
(WebKit::WebResourceLoadStatisticsStore::setResourceLoadStatisticsEnabled):
(WebKit::WebResourceLoadStatisticsStore::resourceLoadStatisticsEnabled):
(WebKit::WebResourceLoadStatisticsStore::readDataFromDiskIfNeeded):
(WebKit::WebResourceLoadStatisticsStore::writeToDisk):
(WebKit::WebResourceLoadStatisticsStore::applicationWillTerminate):

UIProcess/WebResourceLoadStatisticsStore.h: Added.

(WebKit::WebResourceLoadStatisticsStore::coreStore):

UIProcess/WebResourceLoadStatisticsStore.messages.in: Added.
UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:

(WebKit::WebsiteDataStore::platformInitialize): Register a termination handler
to close down the resource load statistics store.

UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::WebsiteDataStore::WebsiteDataStore): Initialize the new WebResourceLoadStatisticsStore
member.
(WebKit::WebsiteDataStore::webProcessWillOpenConnection): Register the WebResourceLoadStatisticsStore
object as a work queue message receiver
(WebKit::WebsiteDataStore::webProcessDidCloseConnection): Unregister WebResourceLoadStatisticsStore.
(WebKit::WebsiteDataStore::resourceLoadStatisticsEnabled): Added.
(WebKit::WebsiteDataStore::setResourceLoadStatisticsEnabled): Ditto.

UIProcess/WebsiteData/WebsiteDataStore.h:

(WebKit::WebsiteDataStore::resourceLoadStatisticsStore): Added.

WebKit2.xcodeproj/project.pbxproj: Add new ResourceLoadStatisticsState files to build.
WebProcess/WebProcess.cpp:

(WebKit::WebProcess::initializeWebProcess): Take into account the new parameter
specifying whether resource load statistics are being captured.
(WebKit::WebProcess::WebProcess): Initialized statistics changed notification timer.
(WebKit::WebProcess::statisticsChangedTimerFired): Added. Send bundles of site load
statistics to the UIProcess on a set interval. Clear out local cache after each send.
(WebKit::WebProcess::setResourceLoadStatisticsEnabled): Added.

WebProcess/WebProcess.h:
WebProcess/WebProcess.messages.in: Add new SetResourceLoadStatisticsEnabled message.

Tools:

MiniBrowser/mac/AppDelegate.m:

(defaultConfiguration): Retrieve state of the ResourceLoadStatisticsEnabled setting.

MiniBrowser/mac/SettingsController.m:

(-[SettingsController _populateMenu]): Move setting from WK1-only to be
universally applicable.

MiniBrowser/mac/WK2BrowserWindowController.m:

(-[WK2BrowserWindowController didChangeSettings]): Recognize when the
Resource Load Statistics flag has changed.

3:28 PM Changeset in webkit [197591] by commit-queue@webkit.org

13 edits in trunk/Source/WebCore

Added missing override specifiers under Source/WebCore.
https://bugs.webkit.org/show_bug.cgi?id=155021

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-03-04
Reviewed by Michael Catanzaro.

No new tests needed.

bridge/NP_jsobject.cpp:
css/CSSStyleSheet.cpp:
dom/MutationObserver.cpp:
editing/DictationCommand.cpp:
editing/EditingStyle.cpp:
loader/EmptyClients.cpp:
loader/SinkDocument.cpp:
page/DOMWindow.cpp:
page/animation/CSSPropertyAnimation.cpp:
platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

Also added #if(SOUP) guard to
ResourceHandleStreamingClient::getOrCreateReadBuffer
because it is not an overridden method otherwise.

platform/text/LineEnding.cpp:
xml/parser/XMLDocumentParserLibxml2.cpp:

2:18 PM Changeset in webkit [197590] by ddkilzer@apple.com

3 edits in trunk/Source/JavaScriptCore

REGRESSION (r197531): JavaScriptCore ASan build fails due to weak external symbol
<http://webkit.org/b/155033>
<rdar://problem/24979661>

Reviewed by Alexey Proskuryakov.

runtime/JSObject.cpp:

(JSC::JSObject::ordinaryToPrimitive): Don't mark this method
inline since it's also used in DatePrototype.cpp, and is
declared as a public class method.

runtime/JSObject.h:

(JSC::JSObject::ordinaryToPrimitive): Don't export this method
since it is not used outside of JavaScriptCore.

2:07 PM Changeset in webkit [197589] by dbates@webkit.org

2 edits in trunk/Source/WebKit2

Temporarily use bundle identifier as part of user directory suffix
https://bugs.webkit.org/show_bug.cgi?id=155042
<rdar://problem/24983174>

Reviewed by Brent Fulgham and Brady Eidson.

Shared/mac/ChildProcessMac.mm:

(WebKit::ChildProcess::initializeSandbox):

1:56 PM Changeset in webkit [197588] by barraclough@apple.com

2 edits in trunk/Source/WebCore

Max out timer throttling immediately for pre-render pages
https://bugs.webkit.org/show_bug.cgi?id=155038

Reviewed by Chris Dumez.

If a hidden page has never been visible, no need to gently ramp into throttling - treat it
the same as a page that has been viewed, but has been in the background for a long time.

Why? The throttling mechanism scales with the amount of background work by shifting the
limit - once all background pages have maxed out the limit, they should no longer be burden
of the system. However the mechanism doesn't currently do anything to accelerate towards
the limit based on the number of pages in the ramp up phase, and ramp up duration is
proportional to limit (so ramping up to a high limit takes a long time). So if you quickly
create a large number of hidden pages the system may be under excessive load for a while,
as we slowly ramp up to a limit that will adequately constrain resource consumption.
In cases where a large number of hidden pages are rapidly generated, many likely remain in
the pre-render state, so this mitigation should typically help.

page/Page.cpp:

(WebCore::Page::updateDOMTimerAlignmentInterval):

if m_isPrerender then m_timerAlignmentInterval is set to the limit.

(WebCore::Page::setIsPrerender):

When this changes updateDOMTimerAlignmentInterval().

1:48 PM Changeset in webkit [197587] by bshafiei@apple.com

1 copy in branches/safari-601.5-branch

New Branch.

1:36 PM Changeset in webkit [197586] by achristensen@apple.com

1 edit
31 deletes in trunk/Tools

Remove vcxproj build system
https://bugs.webkit.org/show_bug.cgi?id=154388

Rubber-stamped by Brent Fulgham.

DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree.sln: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTree.vcxproj: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTree.vcxproj.filters: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeApple.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeCommon.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeDebug.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeDebugWinCairo.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeLauncher.vcxproj: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeLauncherCommon.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeLauncherDebug.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeLauncherProduction.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeLauncherRelease.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreePostBuild.cmd: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreePreBuild.cmd: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeProduction.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeRelease.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/DumpRenderTree/DumpRenderTreeReleaseWinCairo.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiff.vcxproj: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffCommon.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffCommonWinCairo.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffDebug.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffDebugWinCairo.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffLauncher.vcxproj: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffLauncherCommon.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffLauncherDebug.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffLauncherProduction.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffLauncherRelease.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffPostBuild.cmd: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffPreBuild.cmd: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffProduction.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffRelease.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/ImageDiff/ImageDiffReleaseWinCairo.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePlugin.vcxproj: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePlugin.vcxproj.filters: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePluginCommon.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePluginDebug.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePluginPostBuild.cmd: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePluginPreBuild.cmd: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePluginProduction.props: Removed.
DumpRenderTree/DumpRenderTree.vcxproj/TestNetscapePlugin/TestNetscapePluginRelease.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowser.vcxproj: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowser.vcxproj.filters: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserCF.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserCFLite.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserCommon.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserDebug.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserLib.vcxproj: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserLib.vcxproj.filters: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserLibCommon.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserLibDebug.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserLibPostBuild.cmd: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserLibPreBuild.cmd: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserLibProduction.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserLibRelease.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserPostBuild.cmd: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserPreBuild.cmd: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserProduction.props: Removed.
MiniBrowser/MiniBrowser.vcxproj/MiniBrowserRelease.props: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPI.sln: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPI.vcxproj: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPI.vcxproj.filters: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPICommon.props: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPICommonWinCairo.props: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPIDebug.props: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPIDebugWinCairo.props: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPIPostBuild.cmd: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPIPreBuild.cmd: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPIProduction.props: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPIRelease.props: Removed.
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPIReleaseWinCairo.props: Removed.
win/AssembleBuildLogs: Removed.
win/AssembleBuildLogs/AssembleBuildLogs.vcxproj: Removed.
win/AssembleBuildLogs/AssembleBuildLogs.vcxproj.filters: Removed.
win/AssembleBuildLogs/AssembleLogs.cmd: Removed.
win/AssembleBuildLogs/README: Removed.

1:27 PM Changeset in webkit [197585] by Ryan Haddad

2 edits in trunk/LayoutTests

Temporarily skip fast/table/table-overflow.html on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=155036

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

1:19 PM Changeset in webkit [197584] by Ryan Haddad

2 edits in trunk/LayoutTests

Skip fast/text/all-small-caps-whitespace.html on ios-simulator

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

1:05 PM Changeset in webkit [197583] by Ryan Haddad

2 edits in trunk/LayoutTests

Skip storage/indexeddb/modern/256-open-databases.html on mac
https://bugs.webkit.org/show_bug.cgi?id=155028

Unreviewed test gardening.

platform/wk2/TestExpectations:

1:00 PM Changeset in webkit [197582] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

Release build fix after r197572.
https://bugs.webkit.org/show_bug.cgi?id=154993

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:downloadTask:didWriteData:totalBytesWritten:totalBytesExpectedToWrite:]):

12:58 PM Changeset in webkit [197581] by barraclough@apple.com

3 edits in trunk/Source/WebCore

Unify determination of page timer alignment
https://bugs.webkit.org/show_bug.cgi?id=155031

Reviewed by Chris Dumez.

Currently this is scattered throughout Page - sites that call setDOMTimerAlignmentInterval have
to determine the correct alignment interval. Instead, replace setDOMTimerAlignmentInterval with
updateDOMTimerAlignmentInterval, and unify the policy decision here.

page/Page.cpp:

(WebCore::Page::setTimerThrottlingState):

setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval Also, to simplify always record the timestamp when the state changes.

(WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):

setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval

(WebCore::Page::updateDOMTimerAlignmentInterval):

Was setDOMTimerAlignmentInterval, now determines the new alignment value.

(WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):

setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval

(WebCore::Page::setDOMTimerAlignmentInterval): Deleted.

Removed, became updateDOMTimerAlignmentInterval.

page/Page.h:
- setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval m_timerThrottlingEnabledTime -> m_timerThrottlingStateLastChangedTime

12:19 PM Changeset in webkit [197580] by Simon Fraser

2 edits in trunk/Source/WebCore

Fix crash seen in iOS simulator tests
https://bugs.webkit.org/show_bug.cgi?id=155030

Reviewed by Tim Horton.

owningGraphicsLayer() can be null when the tileSizeChangeTimer fires, so null check
it and return, as we do for the tileRevalidationTimer.

platform/graphics/ca/TileController.cpp:

(WebCore::TileController::tileSizeChangeTimerFired):

11:59 AM Changeset in webkit [197579] by achristensen@apple.com

3 edits
95 deletes in trunk/Source

Remove vcxproj build system
https://bugs.webkit.org/show_bug.cgi?id=154388

Rubber-stamped by Brent Fulgham.

Source/JavaScriptCore:

JavaScriptCore.vcxproj/JavaScriptCore.sln: Removed.
JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Removed.
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Removed.
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreCF.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreCFLite.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreCommon.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreDLL.cpp: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreDebug.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Removed.
JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd: Removed.
JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreProduction.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreRelease.props: Removed.
JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props: Removed.
JavaScriptCore.vcxproj/build-generated-files.pl: Removed.
JavaScriptCore.vcxproj/copy-files.cmd: Removed.

Source/WebCore:

WebCore.vcxproj/WebCore.submit.sln: Removed.
WebCore.vcxproj/WebCore.vcxproj: Removed.
WebCore.vcxproj/WebCore.vcxproj.filters: Removed.
WebCore.vcxproj/WebCoreCFNetwork.props: Removed.
WebCore.vcxproj/WebCoreCG.props: Removed.
WebCore.vcxproj/WebCoreCURL.props: Removed.
WebCore.vcxproj/WebCoreCairo.props: Removed.
WebCore.vcxproj/WebCoreCommon.props: Removed.
WebCore.vcxproj/WebCoreDebug.props: Removed.
WebCore.vcxproj/WebCoreDebugWinCairo.props: Removed.
WebCore.vcxproj/WebCoreGenerated.make: Removed.
WebCore.vcxproj/WebCoreGenerated.vcxproj: Removed.
WebCore.vcxproj/WebCoreGenerated.vcxproj.filters: Removed.
WebCore.vcxproj/WebCoreGeneratedCommon.props: Removed.
WebCore.vcxproj/WebCoreGeneratedDebug.props: Removed.
WebCore.vcxproj/WebCoreGeneratedDebugWinCairo.props: Removed.
WebCore.vcxproj/WebCoreGeneratedProduction.props: Removed.
WebCore.vcxproj/WebCoreGeneratedRelease.props: Removed.
WebCore.vcxproj/WebCoreGeneratedReleaseWinCairo.props: Removed.
WebCore.vcxproj/WebCoreGeneratedWinCairo.make: Removed.
WebCore.vcxproj/WebCoreGeneratedWinCairoCommon.props: Removed.
WebCore.vcxproj/WebCoreIncludeCommon.props: Removed.
WebCore.vcxproj/WebCoreMediaQT.props: Removed.
WebCore.vcxproj/WebCorePostBuild.cmd: Removed.
WebCore.vcxproj/WebCorePreBuild.cmd: Removed.
WebCore.vcxproj/WebCoreProduction.props: Removed.
WebCore.vcxproj/WebCoreQuartzCore.props: Removed.
WebCore.vcxproj/WebCoreRelease.props: Removed.
WebCore.vcxproj/WebCoreReleaseWinCairo.props: Removed.
WebCore.vcxproj/WebCoreTestSupport.vcxproj: Removed.
WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters: Removed.
WebCore.vcxproj/WebCoreTestSupportCommon.props: Removed.
WebCore.vcxproj/WebCoreTestSupportDebug.props: Removed.
WebCore.vcxproj/WebCoreTestSupportDebugWinCairo.props: Removed.
WebCore.vcxproj/WebCoreTestSupportProduction.props: Removed.
WebCore.vcxproj/WebCoreTestSupportRelease.props: Removed.
WebCore.vcxproj/WebCoreTestSupportReleaseWinCairo.props: Removed.
WebCore.vcxproj/build-generated-files.pl: Removed.
WebCore.vcxproj/copyForwardingHeaders.cmd: Removed.
WebCore.vcxproj/copyWebCoreResourceFiles.cmd: Removed.
WebCore.vcxproj/migrate-scripts.pl: Removed.

Source/WebKit:

WebKit.vcxproj/Interfaces/FixMIDLHeaders.pl: Removed.
WebKit.vcxproj/Interfaces/Interfaces.vcxproj: Removed.
WebKit.vcxproj/Interfaces/Interfaces.vcxproj.filters: Removed.
WebKit.vcxproj/Interfaces/InterfacesCommon.props: Removed.
WebKit.vcxproj/Interfaces/InterfacesDebug.props: Removed.
WebKit.vcxproj/Interfaces/InterfacesDebugWinCairo.props: Removed.
WebKit.vcxproj/Interfaces/InterfacesPostBuild.cmd: Removed.
WebKit.vcxproj/Interfaces/InterfacesPreBuild.cmd: Removed.
WebKit.vcxproj/Interfaces/InterfacesProduction.props: Removed.
WebKit.vcxproj/Interfaces/InterfacesRelease.props: Removed.
WebKit.vcxproj/Interfaces/InterfacesReleaseWinCairo.props: Removed.
WebKit.vcxproj/WebKit.sln: Removed.
WebKit.vcxproj/WebKit.submit.sln: Removed.
WebKit.vcxproj/WebKit/WebKit.vcxproj: Removed.
WebKit.vcxproj/WebKit/WebKit.vcxproj.filters: Removed.
WebKit.vcxproj/WebKit/WebKitANGLE.props: Removed.
WebKit.vcxproj/WebKit/WebKitApple.props: Removed.
WebKit.vcxproj/WebKit/WebKitCFLite.props: Removed.
WebKit.vcxproj/WebKit/WebKitCommon.props: Removed.
WebKit.vcxproj/WebKit/WebKitDebug.props: Removed.
WebKit.vcxproj/WebKit/WebKitDebugWinCairo.props: Removed.
WebKit.vcxproj/WebKit/WebKitDirectX.props: Removed.
WebKit.vcxproj/WebKit/WebKitPostBuild.cmd: Removed.
WebKit.vcxproj/WebKit/WebKitPreBuild.cmd: Removed.
WebKit.vcxproj/WebKit/WebKitPreLink.cmd: Removed.
WebKit.vcxproj/WebKit/WebKitProduction.props: Removed.
WebKit.vcxproj/WebKit/WebKitRelease.props: Removed.
WebKit.vcxproj/WebKit/WebKitReleaseWinCairo.props: Removed.
WebKit.vcxproj/WebKit/WebKitVersion.cmd: Removed.

11:48 AM Changeset in webkit [197578] by achristensen@apple.com

1 edit
23 deletes in trunk/Source/WTF

Remove vcxproj build system
https://bugs.webkit.org/show_bug.cgi?id=154388

Rubber-stamped by Brent Fulgham.

WTF.vcxproj/WTF.submit.sln: Removed.
WTF.vcxproj/WTF.vcxproj: Removed.
WTF.vcxproj/WTF.vcxproj.filters: Removed.
WTF.vcxproj/WTFCFLite.props: Removed.
WTF.vcxproj/WTFCommon.props: Removed.
WTF.vcxproj/WTFCoreFoundation.props: Removed.
WTF.vcxproj/WTFDebug.props: Removed.
WTF.vcxproj/WTFDebugWinCairo.props: Removed.
WTF.vcxproj/WTFGenerated.make: Removed.
WTF.vcxproj/WTFGenerated.vcxproj: Removed.
WTF.vcxproj/WTFGenerated.vcxproj.filters: Removed.
WTF.vcxproj/WTFGeneratedCommon.props: Removed.
WTF.vcxproj/WTFGeneratedDebug.props: Removed.
WTF.vcxproj/WTFGeneratedProduction.props: Removed.
WTF.vcxproj/WTFGeneratedRelease.props: Removed.
WTF.vcxproj/WTFPostBuild.cmd: Removed.
WTF.vcxproj/WTFPreBuild.cmd: Removed.
WTF.vcxproj/WTFProduction.props: Removed.
WTF.vcxproj/WTFRelease.props: Removed.
WTF.vcxproj/WTFReleaseWinCairo.props: Removed.
WTF.vcxproj/build-generated-files.pl: Removed.
WTF.vcxproj/copy-files.cmd: Removed.
WTF.vcxproj/work-around-vs-dependency-tracking-bugs.py: Removed.

11:42 AM Changeset in webkit [197577] by beidson@apple.com

2 edits in trunk/Source/WebCore

Remove use of deprecated sqlite3_expired
https://bugs.webkit.org/show_bug.cgi?id=155025

Reviewed by Tim Horton.

Since we exclusively use sqlite3_prepare_v2 and don't use sqlite3_prepare,
manually checking for expired statements is not necessary.

platform/sql/SQLiteStatement.cpp:

(WebCore::SQLiteStatement::isExpired): Null check the statement, but don't bother

with sqlite3_expired.

11:30 AM Changeset in webkit [197576] by Chris Dumez

3 edits
2 adds in trunk

Location.reload should not be writable
https://bugs.webkit.org/show_bug.cgi?id=154989

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

After r196770, operations marked as [Unforgeable] in the IDL (such as
Location.reload) are correctly reported as not writable by
Object.getOwnPropertyDescriptor(). Trying to set such property in JS
is correctly ignored (or throws in strict mode) if the object has
previously been reified. However, due to a bug in putEntry(), it was
still possible to override the property if the object was not reified
yet. This patch fixes the issue by checking in putEntry() that entries
that are functions are not ReadOnly before calling putDirect().

runtime/Lookup.h:

(JSC::putEntry):

LayoutTests:

Add a layout test to verify that operations marked as [Unforgeable] in
IDL are indeed not writable.

fast/html/unforgeable-operations-readonly-expected.txt: Added.
fast/html/unforgeable-operations-readonly.html: Added.

11:26 AM Changeset in webkit [197575] by dbates@webkit.org

12 edits
3 moves
3 adds in trunk/Source/WebCore

Move CryptoDigest to WebCore/platform
https://bugs.webkit.org/show_bug.cgi?id=155008
<rdar://problem/24969787>

Reviewed by Brent Fulgham.

CryptoDigest provides a platform-independent interface for interacting with platform-
specific cryptographic hashing services. We currently make use of this code as part
of the implementation of Web Crypto. This code will also be beneficial as part of
implementing support for Content Security Policy inline script and inline stylesheet
hashes. We should move CryptoDigest to WebCore/platform to convey that it a general
purpose platform abstraction.

CMakeLists.txt: Add include directory WebCore/platform/crypto.
PlatformEfl.cmake: Add file platform/crypto/gnutls/CryptoDigestGnuTLS.cpp and

remove file crypto/gnutls/CryptoDigestGnuTLS.cpp.

PlatformGTK.cmake: Ditto.
PlatformMac.cmake: Add file platform/crypto/mac/CryptoDigestMac.cpp and

remove file crypto/mac/CryptoDigestMac.cpp.

WebCore.xcodeproj/project.pbxproj:
crypto/algorithms/CryptoAlgorithmSHA1.cpp:

(WebCore::CryptoAlgorithmSHA1::digest): Substitute "CryptoDigest::Algorithm" for "CryptoAlgorithmIdentifier".

crypto/algorithms/CryptoAlgorithmSHA224.cpp:

(WebCore::CryptoAlgorithmSHA224::digest): Ditto.

crypto/algorithms/CryptoAlgorithmSHA256.cpp:

(WebCore::CryptoAlgorithmSHA256::digest): Ditto.

crypto/algorithms/CryptoAlgorithmSHA384.cpp:

(WebCore::CryptoAlgorithmSHA384::digest): Ditto.

crypto/algorithms/CryptoAlgorithmSHA512.cpp:

(WebCore::CryptoAlgorithmSHA512::digest): Ditto.

crypto/mac/CryptoAlgorithmRSASSA_PKCS1_v1_5Mac.cpp:

(WebCore::getCryptoDigestAlgorithm): Converts a CryptoAlgorithmIdentifier enumerator to a
CryptoDigest::Algorithm enumerator, if applicable.
(WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformSign): Write in terms of WebCore::getCryptoDigestAlgorithm().
(WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformVerify): Ditto.

platform/crypto/CryptoDigest.h: Renamed from Source/WebCore/crypto/CryptoDigest.h. Also added enum CryptoDigest::Algorithm

and changed constructor to take this enum.

platform/crypto/gnutls/CryptoDigestGnuTLS.cpp: Renamed from Source/WebCore/crypto/gnutls/CryptoDigestGnuTLS.cpp.

(WebCore::CryptoDigest::CryptoDigest): Substitute "CryptoDigest::Algorithm" for "CryptoAlgorithmIdentifier".
(WebCore::CryptoDigest::~CryptoDigest): Ditto.
(WebCore::CryptoDigest::create): Ditto.
(WebCore::CryptoDigest::addBytes): Ditto.
(WebCore::CryptoDigest::computeHash): Ditto.

platform/crypto/mac/CryptoDigestMac.cpp: Renamed from Source/WebCore/crypto/mac/CryptoDigestMac.cpp.

(WebCore::toSHA1Context): Ditto.
(WebCore::toSHA224Context): Ditto.
(WebCore::toSHA256Context): Ditto.
(WebCore::toSHA384Context): Ditto.
(WebCore::toSHA512Context): Ditto.
(WebCore::CryptoDigest::CryptoDigest): Ditto.
(WebCore::CryptoDigest::~CryptoDigest): Ditto.
(WebCore::CryptoDigest::create): Ditto.
(WebCore::CryptoDigest::addBytes): Ditto.
(WebCore::CryptoDigest::computeHash): Ditto.

11:13 AM Changeset in webkit [197574] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline inspector/model/remote-object.html for mac after r197539

Unreviewed test gardening.

platform/mac/inspector/model/remote-object-expected.txt:

11:09 AM Changeset in webkit [197573] by mmaxfield@apple.com

8 edits
2 adds in trunk

Whitespace causes font-variant: all-small-caps to synthesize
https://bugs.webkit.org/show_bug.cgi?id=155004
<rdar://problem/24630796>

Reviewed by Darin Adler.

Source/WebCore:

Many fonts (such as Avenir Next) don't report to support whitespace characters under
smcp or c2sc. Previously, we were using this as a signal to synthesize small caps
instead of true small caps. However, a better solution is for whitespace to never
cause synthesis with all-small-caps.

Test: fast/text/all-small-caps-whitespace.html

platform/graphics/mac/ComplexTextController.cpp:

(WebCore::shouldSynthesize):
(WebCore::ComplexTextController::collectComplexTextRuns):

Tools:

DumpRenderTree/mac/DumpRenderTree.mm:

(allowedFontFamilySet):

WebKitTestRunner/InjectedBundle/cocoa/ActivateFontsCocoa.mm:

(WTR::allowedFontFamilySet):

WebKitTestRunner/mac/TestControllerMac.mm:

(WTR::allowedFontFamilySet):

LayoutTests:

fast/text/all-small-caps-whitespace-expected.html: Added.
fast/text/all-small-caps-whitespace.html: Added.
platform/mac/TestExpectations: Skip on platforms which don't support proper coverage

queries.

11:05 AM Changeset in webkit [197572] by achristensen@apple.com

4 edits in trunk/Source

Use NSURLSession for loading in WebKit2
https://bugs.webkit.org/show_bug.cgi?id=154993

Reviewed by Sam Weinig.

Source/WebKit2:

config.h:

Source/WTF:

wtf/Platform.h:

10:48 AM Changeset in webkit [197571] by Simon Fraser

26 edits in trunk/LayoutTests

REGRESSION (r197541): many tiled drawing tests failing after new "large tile size" logic was added
https://bugs.webkit.org/show_bug.cgi?id=155020

Rebaseline these tests.

platform/mac-wk2/TestExpectations:
tiled-drawing/background-transparency-toggle-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-iframe-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-iframe-with-handler-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-mainframe-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-mainframe-with-handler-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-background-no-image-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-body-layer-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-opacity-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-positioned-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-html-background-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-non-propagated-body-background-expected.txt:
tiled-drawing/scrolling/fixed/four-bars-zoomed-expected.txt:
tiled-drawing/scrolling/scroll-snap/scroll-snap-mandatory-2d-overflow-expected.txt:
tiled-drawing/scrolling/scroll-snap/scroll-snap-mandatory-borders-expected.txt:
tiled-drawing/scrolling/scroll-snap/scroll-snap-mandatory-overflow-expected.txt:
tiled-drawing/tile-coverage-after-scroll-expected.txt:
tiled-drawing/tile-coverage-after-scroll-speculative-expected.txt:
tiled-drawing/tile-coverage-scroll-to-bottom-expected.txt:
tiled-drawing/tile-coverage-slow-scrolling-expected.txt:
tiled-drawing/tile-coverage-speculative-expected.txt:
tiled-drawing/tile-size-unscrollable-expected.txt:
tiled-drawing/tile-size-vertically-scrollable-expected.txt:
tiled-drawing/visible-rect-content-inset-expected.txt:

10:30 AM Changeset in webkit [197570] by mmaxfield@apple.com

4 edits
4 adds in trunk

[iOS] Crash during font loading when injected bundle cancels load
https://bugs.webkit.org/show_bug.cgi?id=155001

Reviewed by Tim Horton.

Source/WebCore:

If a injected bundle cancels the load, the fontLoaded() callback will be
called twice. We can simply detect this condition.

Test: CancelLoading.CancelFontSubresource API test

css/CSSFontFaceSource.cpp:

(WebCore::CSSFontFaceSource::fontLoaded):

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2/Ahem.ttf: Added.
TestWebKitAPI/Tests/WebKit2/webfont.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/CancelFontSubresource.mm: Added.

(-[Myles webView:didFinishNavigation:]):
(TEST):

TestWebKitAPI/Tests/WebKit2Cocoa/CancelFontSubresourcePlugIn.mm: Added.

(-[CancelFontSubresourcePlugIn webProcessPlugIn:didCreateBrowserContextController:]):
(-[CancelFontSubresourcePlugIn webProcessPlugInBrowserContextController:frame:willSendRequestForResource:request:redirectResponse:]):

10:27 AM Changeset in webkit [197569] by adachan@apple.com

2 edits in trunk/Source/WebCore

The visibility of the airplay menu also depends on whether there's a custom menu item.
https://bugs.webkit.org/show_bug.cgi?id=154987

Reviewed by Darin Adler.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::enqueuePlaybackTargetAvailabilityChangedEvent):

10:01 AM Changeset in webkit [197568] by achristensen@apple.com

3 edits
1 add in trunk/Source/WebKit2

Use NetworkSession for pings
https://bugs.webkit.org/show_bug.cgi?id=154984

Reviewed by Antti Koivisto.

Before this patch, we were using NSURLConnection for pings when the rest of the loading was being
done with NSURLSession. To fix this, I implemented PingLoad, which is the NetworkSession equivalent
of PingHandle.

This fixes http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https.html

NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::loadPing):
(WebKit::NetworkConnectionToWebProcess::removeLoadIdentifier):

NetworkProcess/PingLoad.h: Added.

(WebKit::PingLoad::PingLoad):
(WebKit::PingLoad::willPerformHTTPRedirection):
(WebKit::PingLoad::didReceiveChallenge):
(WebKit::PingLoad::didReceiveResponseNetworkSession):
(WebKit::PingLoad::didReceiveData):
(WebKit::PingLoad::didCompleteWithError):
(WebKit::PingLoad::didBecomeDownload):
(WebKit::PingLoad::didSendData):
(WebKit::PingLoad::wasBlocked):
(WebKit::PingLoad::cannotShowURL):
(WebKit::PingLoad::timeoutTimerFired):
(WebKit::PingLoad::~PingLoad):

WebKit2.xcodeproj/project.pbxproj:

9:58 AM Changeset in webkit [197567] by commit-queue@webkit.org

3 edits in trunk/Tools

[check-webkit-style] Added checks for redundant virtual specifiers.
https://bugs.webkit.org/show_bug.cgi?id=155017

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-03-04
Reviewed by Darin Adler.

Added 3 new checks related to virtual, override, and final specifiers:

When "override" is present, "virtual" is redundant.
When "final" is present, "virtual" is redundant.
When "final" is present, "override" is redundant.

Scripts/webkitpy/style/checkers/cpp.py:

(_FunctionState.begin):
(_FunctionState.is_virtual):
(_check_parameter_name_against_text):
(_error_redundant_specifier):
(check_function_definition):
(CppChecker):

Scripts/webkitpy/style/checkers/cpp_unittest.py:

(FunctionDetectionTest.perform_function_detection):
(FunctionDetectionTest.test_basic_function_detection):
(FunctionDetectionTest.test_function_declaration_detection):
(FunctionDetectionTest.test_pure_function_detection):
(FunctionDetectionTest.test_override_and_final_function_detection):
(FunctionDetectionTest.test_non_functions):
(FunctionDetectionTest.test_parameter_list):

9:20 AM Changeset in webkit [197566] by Darin Adler

165 edits in trunk

Followup to:
Remove "virtual" from all lines that have both "virtual" and "override".
https://bugs.webkit.org/show_bug.cgi?id=155005

Reviewed by Geoffrey Garen.

Scripts/do-webcore-rename: Added more regular expressions to make sure we always

use either override or final, not both, and to remove virtual from all lines that
have both virtual and final.

9:02 AM Changeset in webkit [197565] by Darin Adler

3 edits in trunk/LayoutTests

REGRESSION (r197541): many tiled drawing tests failing after new "large tile size" logic was added
https://bugs.webkit.org/show_bug.cgi?id=155020

platform/mac-wk2/TestExpectations: Added failure expectations for tiled drawing tests.
platform/wk2/TestExpectations: Moved some expectations to a more appropriate section in the file.

8:55 AM Changeset in webkit [197564] by timothy@apple.com

14 edits in trunk/Source

Inform WebKit and WebCore if a page is controlled by automation.

https://bugs.webkit.org/show_bug.cgi?id=154991
rdar://problem/24965784

Reviewed by Joseph Pecoraro.

Source/WebCore:

page/Page.h:

(WebCore::Page::isControlledByAutomation): Added.
(WebCore::Page::setControlledByAutomation): Added.

Source/WebKit2:

Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode):
(WebKit::WebPageCreationParameters::decode):

Shared/WebPageCreationParameters.h:
UIProcess/API/C/WKPage.cpp:

(WKPageGetIsControlledByAutomation):
(WKPageSetControlledByAutomation):

UIProcess/API/C/WKPagePrivate.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::setControlledByAutomation):
(WebKit::WebPageProxy::creationParameters):

UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::isControlledByAutomation):

WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:

(WKBundlePageIsControlledByAutomation):

WebProcess/InjectedBundle/API/c/WKBundlePage.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::m_shouldDispatchFakeMouseMoveEvents):
(WebKit::WebPage::isControlledByAutomation):
(WebKit::WebPage::setControlledByAutomation):

WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:

8:47 AM Changeset in webkit [197563] by Darin Adler

1432 edits in trunk

Remove "virtual" from all lines that have both "virtual" and "override".
https://bugs.webkit.org/show_bug.cgi?id=155005

Reviewed by Geoffrey Garen.

Scripts/do-webcore-rename: Added a regular expression to this script to do the job.

5:26 AM Changeset in webkit [197562] by Carlos Garcia Campos

1 edit in releases/WebKitGTK/webkit-2.4/Source/JavaScriptCore/interpreter/JSStack.cpp

Merge r193648 - Crashes on PPC64 due to mprotect() on address not aligned to the page size
https://bugs.webkit.org/show_bug.cgi?id=130237

Reviewed by Mark Lam.

Make sure that commitSize is at least as big as the page size.

interpreter/JSStack.cpp:

(JSC::commitSize):
(JSC::JSStack::JSStack):
(JSC::JSStack::growSlowCase):

interpreter/JSStack.h:

5:20 AM Changeset in webkit [197561] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.4/Source/JavaScriptCore

Merge r193648 - Crashes on PPC64 due to mprotect() on address not aligned to the page size
https://bugs.webkit.org/show_bug.cgi?id=130237

Reviewed by Mark Lam.

Make sure that commitSize is at least as big as the page size.

interpreter/JSStack.cpp:

(JSC::commitSize):
(JSC::JSStack::JSStack):
(JSC::JSStack::growSlowCase):

interpreter/JSStack.h:

5:17 AM WebKitGTK/2.4.x edited by Carlos Garcia Campos

(diff)

5:06 AM WebKitGTK/2.4.x edited by Carlos Garcia Campos

(diff)

5:04 AM Changeset in webkit [197560] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WTF

Merge r185863 - [WTF] Platform.h: use _ABI64 instead of _MIPS_SIM_ABI64 to determine MIPS N64
https://bugs.webkit.org/show_bug.cgi?id=145113

Patch by YunQiang Su <wzssyqa@gmail.com> on 2015-06-22
Reviewed by Csaba Osztrogonác.

wtf/Platform.h:

5:03 AM Changeset in webkit [197559] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r169665 - Initialize a char* that needs to be initialized.
<rdar://problem/15840022> and https://bugs.webkit.org/show_bug.cgi?id=133585

Reviewed by Mark Rowe.

r152134 (erroneously) removed this initialization.

platform/sql/SQLiteStatement.cpp:

(WebCore::SQLiteStatement::prepare): tail should start out initialized to 0.

5:01 AM Changeset in webkit [197558] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.4/Source/JavaScriptCore

Merge r167031 - Ensure that LLINT accessing of the ProtoCallFrame is big endian friendly.
<https://webkit.org/b/131449>

Reviewed by Mark Hahnenberg.

Change ProtoCallFrame::paddedArgCount to be of type uint32_t. The argCount
that it pads is of type int anyway. It doesn't need to be 64 bit. This
also makes it work with the LLINT which is loading it with a loadi
instruction.

We should add the PayLoadOffset to ProtoCallFrame::argCountAndCodeOriginValue
when loading the argCount.

interpreter/ProtoCallFrame.h:

(JSC::ProtoCallFrame::setPaddedArgCount):

llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:

4:57 AM Changeset in webkit [197557] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.4/Source

Merge r176519 - Webkit2 doesnt build on powerpc 32 bits
https://bugs.webkit.org/show_bug.cgi?id=130837

Reviewed by Carlos Garcia Campos.

Check if libatomic is needed in order to use std::atomic, and add
it to the list of WebKit2 libraries.

PlatformGTK.cmake:

4:54 AM Changeset in webkit [197556] by Carlos Garcia Campos

8 edits in releases/WebKitGTK/webkit-2.4

Merge r166232 - [EFL] Add ARM64 build support
https://bugs.webkit.org/show_bug.cgi?id=130506

Rubber stamped by Gyuyoung Kim.

CMakeLists.txt: Set WTF_CPU_ARM64 when aarch64 is defined.

Source/ThirdParty:

leveldb/port/atomic_pointer.h: Set ARCH_CPU_ARM_FAMILY when aarch64 is defined.

Source/WTF:

wtf/Platform.h: Set WTF_CPU_ARM64 when aarch64 is defined.

Tools:

Scripts/webkitdirs.pm:

(isARM): Detect aarch64 as ARM.

4:51 AM Changeset in webkit [197555] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Tools

Merge r164794 - [gtk-doc] UnicodeEncodeError: 'ascii' codec can't encode character
https://bugs.webkit.org/show_bug.cgi?id=128927

Reviewed by Philippe Normand.

Encode manually the data for sys.{stdout,stderr}.write.

gtk/gtkdoc.py:

(GTKDoc._run_command):

1:52 AM Changeset in webkit [197554] by gskachkov@gmail.com

9 edits in trunk

[ES6] Arrow function syntax. Lexical bind super inside of the arrow function in generator.
https://bugs.webkit.org/show_bug.cgi?id=152575

Reviewed by Yusuke Suzuki.

Added support of the 'SuperProperty' in arrow function within of the generator
method of class. Before patch parser did not recognize that current arrow function
is declated inside of the generator and raise SyntaxError.

Source/JavaScriptCore:

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseFunctionInfo):

parser/Parser.h:

(JSC::Scope::Scope):
(JSC::Scope::isGeneratorBoundary):
(JSC::Scope::setIsFunction):
(JSC::Scope::setIsGenerator):
(JSC::Parser::closestParentOrdinaryFunctionNonLexicalScope):

tests/stress/arrowfunction-lexical-bind-superproperty.js:

LayoutTests:

js/arrowfunction-superproperty-expected.txt:
js/arrowfunction-syntax-errors-expected.txt:
js/script-tests/arrowfunction-superproperty.js:
js/script-tests/arrowfunction-syntax-errors.js:

1:29 AM Changeset in webkit [197553] by Antti Koivisto

4 edits
2 adds in trunk

ComposedTreeIterator may traverse slotted nodes multiple times
https://bugs.webkit.org/show_bug.cgi?id=154983

Reviewed by Ryosuke Niwa.

Source/WebCore:

Traversal of slotted nodes can escape to real siblings. Those siblings are then traversed again as slotted nodes.

Test: fast/shadow-dom/composed-tree-slots.html

dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::initializeContextStack):
(WebCore::ComposedTreeIterator::traverseNextInShadowTree):
(WebCore::ComposedTreeIterator::traverseNextLeavingContext):
(WebCore::ComposedTreeIterator::advanceInSlot):

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::Context::Context):

Include end iterator to the context.
For slotted nodes set it up to point to the next sibling of the node.

(WebCore::ComposedTreeIterator::context):
(WebCore::ComposedTreeIterator::traverseNextSkippingChildren):

LayoutTests:

fast/shadow-dom/composed-tree-slots-expected.txt: Added.
fast/shadow-dom/composed-tree-slots.html: Added.

1:03 AM Changeset in webkit [197552] by akling@apple.com

3 edits in trunk/Source/WebCore

Drop DocumentSharedObjectPool immediately when going into PageCache.
<https://webkit.org/b/154986>

Reviewed by Antti Koivisto.

The DocumentSharedObjectPool is a weirdly efficient little optimization
that deduplicates ElementData during the first 10s of a Document's lifetime.
While it's up, every ElementData created will persist so it can be used for
deduplication.

If a Document goes into the PageCache while its shared object pool is still
alive, we can just kill it right away. This will sometimes allow us to free
a bunch of ElementData sooner.

dom/Document.cpp:

(WebCore::Document::Document):
(WebCore::Document::setInPageCache):
(WebCore::Document::clearSharedObjectPool):
(WebCore::Document::sharedObjectPoolClearTimerFired): Deleted.

dom/Document.h:

12:27 AM Changeset in webkit [197551] by youenn.fablet@crf.canon.fr

7 edits in trunk/Source/WebCore

Remove PassRefPtr from ThreadableLoader and relatives
https://bugs.webkit.org/show_bug.cgi?id=154966

Reviewed by Darin Adler.

Covered by existing tests.

loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::create):

loader/DocumentThreadableLoader.h:
loader/ThreadableLoader.cpp:

(WebCore::ThreadableLoader::create):

loader/ThreadableLoader.h:
loader/WorkerThreadableLoader.cpp:

(WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
(WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):

loader/WorkerThreadableLoader.h:

Mar 3, 2016:

11:41 PM Changeset in webkit [197550] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

Let XCode have its own way and also sort the file.

WebCore.xcodeproj/project.pbxproj:

10:36 PM Changeset in webkit [197549] by fpizlo@apple.com

22 edits
6 adds in trunk

DFG/FTL should inline accesses to RegExpObject::m_lastIndex
https://bugs.webkit.org/show_bug.cgi?id=155003

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

The Octane/regexp benchmark sets RegExps' lastIndex a lot. I could imagine this being
something that people want to do. Right now, I'm not convinced that making the RegExp object
be more plain-JS would be a good idea considering that pretty much all uses of it will
require some special compiler magic. Also, it's good that this patch teaches the compiler
how to reason about lastIndex since some of my other plans for regexp involve having the
compiler treat more regexp stuff as intrinsic.

This is a smaller Octane/regexp speed-up than I hoped - maybe around 1%. It's an enormous
speed-up on the microbenchmarks attached to this patch.

dfg/DFGAbstractHeap.h:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGHeapLocation.h:
dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):
(JSC::DFG::SpeculativeJIT::compileGetRegExpObjectLastIndex):
(JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStoreBarrierInsertionPhase.cpp:
ftl/FTLAbstractHeapRepository.cpp:
ftl/FTLAbstractHeapRepository.h:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
(JSC::FTL::DFG::LowerDFGToB3::compileGetRegExpObjectLastIndex):
(JSC::FTL::DFG::LowerDFGToB3::compileSetRegExpObjectLastIndex):
(JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
(JSC::FTL::DFG::LowerDFGToB3::lowObject):
(JSC::FTL::DFG::LowerDFGToB3::lowRegExpObject):
(JSC::FTL::DFG::LowerDFGToB3::lowString):

runtime/RegExpObject.h:

(JSC::RegExpObject::createStructure):
(JSC::RegExpObject::offsetOfLastIndex):

LayoutTests:

js/regress/regexp-last-index-expected.txt: Added.
js/regress/regexp-last-index.html: Added.
js/regress/regexp-set-last-index-expected.txt: Added.
js/regress/regexp-set-last-index.html: Added.
js/regress/script-tests/regexp-last-index.js: Added.
js/regress/script-tests/regexp-set-last-index.js: Added.

10:00 PM Changeset in webkit [197548] by Chris Dumez

9 edits in trunk/Source

Regression(r196770): Unable to use HipChat Mac app
https://bugs.webkit.org/show_bug.cgi?id=154999
<rdar://problem/24931959>

Reviewed by Darin Adler.

Source/JavaScriptCore:

Add a setter to PutPropertySlot to override the 'isStrictMode' flag.

runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::setStrictMode):

Source/WebCore:

r196770 made [Unforgeable] operations such as Location.reload()
non-writable as per the Web IDL specification. As a result,
trying to set such properties will be ignored in non-strict
mode and will throw an exception is strict mode. This also matches
Firefox and Chrome.

However, this broke the HipChat Mac App (the Web App seems fine)
because it sets Location.reload() and is using strict mode, therefore
causing an exception to be thrown.

This patch adds a quirk to JSLocation::putDelegate() which disable
strict mode when we detect that the application is HipChat. As a
result, we no longer throw when HipChat tries to set Location.reload
and the application is able to connect again.

bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::putDelegate):
Add a quirk which disables strict mode if the application is HipChat.

platform/RuntimeApplicationChecks.cpp:

(WebCore::mainBundleIdentifier):
Extract this from mainBundleIsEqualTo() so it can be shared with
applicationBundleIdentifier().

(WebCore::applicationBundleIdentifier):
Returns the application bundle identifier, which is a static variable.
For the WebContent / Networking processes, the application bundle
identifier gets set to the UIProcess bundle identifier upon
initialization. If unset, we fall back to using mainBundleIdentifier()
which will do the right thing for the WK2 UIProcess and WK1.

(WebCore::mainBundleIsEqualTo):
Extract part of the code to mainBundleIdentifier() to better share
code.

(WebCore::applicationIsHipChat):
Add utility function that checks if the application is HipChat. This
will do the right thing whether it is called from the UIProcess, the
WebProcess or the UIProcess.

(WebCore::setApplicationBundleIdentifier):
Add utility function to set the application bundle identifier. It gets
called with the UIProcess bundle identifier by the NetworkProcess and
the WebProcess upon initialization.

platform/RuntimeApplicationChecks.h:

Source/WebKit2:

Have the NetworkProcess and the WebProcess pass the UIProcess bundle
identifier to WebCore so that we can do app detection of applications
using a WK2 WebView (such as HipChat).

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::initializeNetworkProcess):

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::initializeWebProcess):

9:49 PM Changeset in webkit [197547] by fpizlo@apple.com

1 edit
3 deletes in trunk/LayoutTests

Unreviewed, remove test with flaky timeout that doesn't test anything anymore. This test
was relevant back when arguments got torn off; something that we don't do anymore. It
uses a loop that waits for the top-tier compiler to compile it. We don't write tests
like that anymore.

js/dfg-osr-exit-between-create-and-tearoff-arguments-expected.txt: Removed.
js/dfg-osr-exit-between-create-and-tearoff-arguments.html: Removed.
js/script-tests/dfg-osr-exit-between-create-and-tearoff-arguments.js: Removed.

8:40 PM Changeset in webkit [197546] by commit-queue@webkit.org

5 edits in trunk/Source/JavaScriptCore

[JSC] Add support for MADD, MSUB and MNEG to Air
https://bugs.webkit.org/show_bug.cgi?id=154997

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-03-03
Reviewed by Filip Pizlo.

ARM64 can do an Add/Sub in the Multiply units.
LLVM was doing so but we lost that when switching to B3.

This patch adds those instructions in Air.

There are more ALUs than multiply units, thus we are more
likely to successfully schedule a Multiply+Add than 2 Multiply.
I am conservative and only emit a multiply-add if the value
can be interned. As far as I can tell from what is generated
by LLVM, that backend had the same rule.

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::multiplyAdd32):
(JSC::MacroAssemblerARM64::multiplySub32):
(JSC::MacroAssemblerARM64::multiplyNeg32):
(JSC::MacroAssemblerARM64::multiplyAdd64):
(JSC::MacroAssemblerARM64::multiplySub64):
(JSC::MacroAssemblerARM64::multiplyNeg64):

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::lower):

b3/air/AirOpcode.opcodes:
b3/testb3.cpp:

(JSC::B3::populateWithInterestingValues):
(JSC::B3::floatingPointOperands):
(JSC::B3::int64Operands):
(JSC::B3::int32Operands):
(JSC::B3::testMulAddArgsLeft):
(JSC::B3::testMulAddArgsRight):
(JSC::B3::testMulAddArgsLeft32):
(JSC::B3::testMulAddArgsRight32):
(JSC::B3::testMulSubArgsLeft):
(JSC::B3::testMulSubArgsRight):
(JSC::B3::testMulSubArgsLeft32):
(JSC::B3::testMulSubArgsRight32):
(JSC::B3::testMulNegArgs):
(JSC::B3::testMulNegArgs32):
(JSC::B3::run):

8:02 PM Changeset in webkit [197545] by ggaren@apple.com

16 edits
4 adds in trunk/Source/bmalloc

Unreviewed, rolling in r197174.
https://bugs.webkit.org/show_bug.cgi?id=154762

The right calculation for alignment is actually:

vmAlignment - getpagesize() + vmSize

instead of:

vmAlignment - vmPageSize + vmSize

The vmPageSize might be larger than getpagesize().

Restored changeset:

"bmalloc: Added a fast XLarge allocator"
https://bugs.webkit.org/show_bug.cgi?id=154720
http://trac.webkit.org/changeset/197174

7:43 PM Changeset in webkit [197544] by sbarati@apple.com

5 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Implement Proxy.SetPrototypeOf
https://bugs.webkit.org/show_bug.cgi?id=154931

Reviewed by Ryosuke Niwa.

This patch is a straight forward implementation of Proxy.SetPrototypeOf
with respect to section 9.5.2 of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v

runtime/JSObject.cpp:

(JSC::JSObject::putInlineSlow):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::put):
(JSC::ProxyObject::getGenericPropertyNames):
(JSC::ProxyObject::performSetPrototype):
(JSC::ProxyObject::setPrototype):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h:
tests/es6.yaml:
tests/stress/proxy-set-prototype-of.js: Added.

(assert):
(throw.new.Error.let.handler.get setPrototypeOf):
(throw.new.Error.set let):
(throw.new.Error.set catch):
(throw.new.Error):
(assert.let.handler.setPrototypeOf):
(assert.set let):
(assert.set catch):
(let.handler.setPrototypeOf):
(set let):
(set catch):

7:19 PM Changeset in webkit [197543] by keith_miller@apple.com

14 edits
3 adds in trunk

JSArrayBuffers should be collected less aggressively
https://bugs.webkit.org/show_bug.cgi?id=154982

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

We are currently too aggressive in our collection of ArrayBuffer wrappers.
There are three cases where we need to avoid collecting ArrayBuffer wrappers.

If the wrapper has custom properties.
If the wrapper is a subclass of ArrayBuffer.
If the wrapper is in a WeakMap/WeakSet.

Currently, we only pass the first case in WebCore and none in the jsc CLI.
This patch removes some optimizations that cause us to collect when we
should not. Namely, always skipping the object unless it has custom
properties. Additionally, in the case of subclassing, we also need a way
for custom JSArrayBuffer objects to register themselves as the wrapper for
an ArrayBuffer class.

Finally, this patch fixes an issue where views would not mark their ArrayBuffer
as an opaque root. This patch also moves an associated ASSERT that the
ArrayBuffer held by a view is not null in JSGenericTypedArrayView::visitChildren
into JSArrayBufferView::visitChildren, where we add the opaque root.

runtime/JSArrayBuffer.cpp:

(JSC::JSArrayBuffer::finishCreation):
(JSC::JSArrayBuffer::create):
(JSC::JSArrayBuffer::createWithoutWrapping):

runtime/JSArrayBuffer.h:
runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::visitChildren):

runtime/JSArrayBufferView.h:
runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::visitChildren): Deleted.

runtime/SimpleTypedArrayController.cpp:

(JSC::SimpleTypedArrayController::toJS):
(JSC::SimpleTypedArrayController::registerWrapper):
(JSC::SimpleTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots):
(JSC::SimpleTypedArrayController::JSArrayBufferOwner::finalize):

runtime/SimpleTypedArrayController.h:
runtime/TypedArrayController.h:

Source/WebCore:

We are currently too aggressive in our collection of ArrayBuffer wrappers.
There are three cases where we need to avoid collecting ArrayBuffer wrappers.

If the wrapper has custom properties.
If the wrapper is a subclass of ArrayBuffer.
If the wrapper is in a WeakMap/WeakSet.

Finally, this patch removes an unnecessary ref() and deref() of
ArrayBuffer objects during the creation/destruction of the wrapper.
Since an ArrayBuffer object's GC lifetime will be at least as long
as the lifetime of the wrapper we are creating for it we don't need
to ref() and deref() the ArrayBuffer object. This lifetime is
guaranteed because ArrayBuffer objects are both GCed and refcounted
and any new wrapper will visit the ArrayBuffer object as long as the
wrapper is still alive.

Test: js/arraybuffer-wrappers.html

bindings/js/JSDOMBinding.h:

(WebCore::toJS):

bindings/js/WebCoreTypedArrayController.cpp:

(WebCore::WebCoreTypedArrayController::registerWrapper):
(WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::finalize):
(WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots): Deleted.

bindings/js/WebCoreTypedArrayController.h:

LayoutTests:

js/arraybuffer-wrappers-expected.txt: Added.
js/arraybuffer-wrappers.html: Added.
js/script-tests/arraybuffer-wrappers.js: Added.

(prototype.types.forEach):

6:43 PM Changeset in webkit [197542] by fpizlo@apple.com

4 edits in trunk/Source/JavaScriptCore

Octane/regexp's Exec function should benefit from array length accessor inlining
https://bugs.webkit.org/show_bug.cgi?id=154994

Reviewed by Benjamin Poulain.

It does:

var thingy = blahbitty.blah;
if (thingy)

foo = thingy.length;

So, 'thingy' is SpecArray | SpecOther, which prevents the array length accessor inlining from
kicking in. Our strategy for this elsewhere in the DFG is to allow a one-time speculation that
we won't see SpecOther, since *usually* we see SpecOther mixed with other stuff in cases like
this where there is some null check guarding the code.

This gives another slight speed-up on Octane/regexp.

bytecode/SpeculatedType.h:

(JSC::isCellSpeculation):
(JSC::isCellOrOtherSpeculation):
(JSC::isNotCellSpeculation):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateCell):
(JSC::DFG::Node::shouldSpeculateCellOrOther):
(JSC::DFG::Node::shouldSpeculateNotCell):

6:26 PM Changeset in webkit [197541] by Simon Fraser

43 edits
4 copies
5 adds in trunk

Use larger tiles when possible to reduce per-tile painting overhead
https://bugs.webkit.org/show_bug.cgi?id=154985
rdar://problem/23635219

Reviewed by Tim Horton.
Source/WebCore:

There's no reason to use lots of 512x512 tiles on a non-scrollable page. We can reduce
per-tile painting overhead by using one big tile. On vertically scrolling pages, we
can also use wide tiles to reduce tile-crossing when painting. Have FrameView tell
the TiledBacking about scrollability, allowing TileController to make tile size decisions.

Change the "giant tile" code path to just return whether Settings says we're in giant
tile mode, so that tile size decisions can be made in TileController.

TileController now stores a single margin size, and a per-edge margin flag rather than a size
per edge. It computes tile size based on scrollability, but adjusts tile size with some
hysteresis to avoid size thrashing for content that frequently resizes the document (e.g.
some performance tests).

TileGrid stores a copy of the tile size, so that it remains unchanged from one revalidate
to the next, and the grid can detect when the tile size changes, since it needs to throw away
all tiles in that case.

Tests: tiled-drawing/tile-size-both-scrollable.html

tiled-drawing/tile-size-horizontally-scrollable.html
tiled-drawing/tile-size-unscrollable.html
tiled-drawing/tile-size-vertically-scrollable.html

WebCore.xcodeproj/project.pbxproj:
page/FrameView.cpp:

(WebCore::FrameView::addedOrRemovedScrollbar):
(WebCore::FrameView::willStartLiveResize): Tell the tile backing when live resize starts and stops.
(WebCore::FrameView::willEndLiveResize):

platform/graphics/EdgeSet.h: Added. Template class that just stores some value

per edge.
(WebCore::EdgeSet::EdgeSet):
(WebCore::EdgeSet::top):
(WebCore::EdgeSet::setTop):
(WebCore::EdgeSet::right):
(WebCore::EdgeSet::setRight):
(WebCore::EdgeSet::bottom):
(WebCore::EdgeSet::setBottom):
(WebCore::EdgeSet::left):
(WebCore::EdgeSet::setLeft):
(WebCore::EdgeSet::operator==):
(WebCore::EdgeSet::operator!=):

platform/graphics/GraphicsLayerClient.h: Rather than have the client return the

tile size, have it return whether we're in giant tile mode.
(WebCore::GraphicsLayerClient::useGiantTiles):
(WebCore::GraphicsLayerClient::tileSize): Deleted.

platform/graphics/TiledBacking.h:

(WebCore::defaultTileSize): Deleted.

platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayerCA::platformCALayerUseGiantTiles):
(WebCore::GraphicsLayerCA::platformCALayerTileSize): Deleted.

platform/graphics/ca/GraphicsLayerCA.h:
platform/graphics/ca/PlatformCALayerClient.h:

(WebCore::PlatformCALayerClient::platformCALayerUseGiantTiles):
(WebCore::PlatformCALayerClient::platformCALayerTileSize): Deleted.

platform/graphics/ca/TileController.cpp:

(WebCore::TileController::TileController):
(WebCore::TileController::setScrollability):
(WebCore::TileController::willStartLiveResize):
(WebCore::TileController::didEndLiveResize):
(WebCore::TileController::tileSize):
(WebCore::TileController::setHasMargins):
(WebCore::TileController::setMarginSize):
(WebCore::TileController::hasMargins):
(WebCore::TileController::hasHorizontalMargins):
(WebCore::TileController::hasVerticalMargins):
(WebCore::TileController::topMarginHeight):
(WebCore::TileController::bottomMarginHeight):
(WebCore::TileController::leftMarginWidth):
(WebCore::TileController::rightMarginWidth):
(WebCore::TileController::setTileMargins): Deleted.

platform/graphics/ca/TileController.h:
platform/graphics/ca/TileGrid.cpp:

(WebCore::TileGrid::TileGrid):
(WebCore::TileGrid::setNeedsDisplayInRect):
(WebCore::TileGrid::rectForTileIndex):
(WebCore::TileGrid::getTileIndexRangeForRect):
(WebCore::TileGrid::removeAllTiles):
(WebCore::TileGrid::revalidateTiles):

platform/graphics/ca/TileGrid.h:

(WebCore::TileGrid::tileSize):

rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::setTiledBackingHasMargins):
(WebCore::RenderLayerBacking::useGiantTiles):
(WebCore::RenderLayerBacking::tileSize): Deleted.

rendering/RenderLayerBacking.h:

Source/WebKit2:

Do a bit of #include cleanup.

Shared/mac/RemoteLayerBackingStore.mm:
WebProcess/WebPage/mac/PlatformCALayerRemote.h:
WebProcess/WebPage/mac/PlatformCALayerRemoteTiledBacking.cpp:
WebProcess/WebPage/mac/PlatformCALayerRemoteTiledBacking.h:

LayoutTests:

Rebaseline tests with new tile sizes. Add new tests that explicitly test tile size on
pages with different scrollability.

tiled-drawing/background-transparency-toggle-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-iframe-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-iframe-with-handler-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-mainframe-expected.txt:
tiled-drawing/scrolling/fast-scroll-iframe-latched-mainframe-with-handler-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-background-no-image-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-body-layer-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-opacity-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-body-background-positioned-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-html-background-expected.txt:
tiled-drawing/scrolling/fixed-background/fixed-non-propagated-body-background-expected.txt:
tiled-drawing/tile-coverage-after-scroll-expected.txt:
tiled-drawing/tile-coverage-after-scroll-speculative-expected.txt:
tiled-drawing/tile-coverage-scroll-to-bottom-expected.txt:
tiled-drawing/tile-coverage-slow-scrolling-expected.txt:
tiled-drawing/tile-coverage-speculative-expected.txt:
tiled-drawing/tile-size-both-scrollable-expected.txt: Copied from LayoutTests/tiled-drawing/scrolling/fixed-background/fixed-background-no-image-expected.txt.
tiled-drawing/tile-size-both-scrollable.html: Added.
tiled-drawing/tile-size-horizontally-scrollable-expected.txt: Copied from LayoutTests/tiled-drawing/scrolling/fixed-background/fixed-background-no-image-expected.txt.
tiled-drawing/tile-size-horizontally-scrollable.html: Added.
tiled-drawing/tile-size-unscrollable-expected.txt: Added.
tiled-drawing/tile-size-unscrollable.html: Added.
tiled-drawing/tile-size-vertically-scrollable-expected.txt: Copied from LayoutTests/tiled-drawing/scrolling/fixed-background/fixed-background-no-image-expected.txt.
tiled-drawing/tile-size-vertically-scrollable.html: Added.
tiled-drawing/visible-rect-content-inset-expected.txt:

6:26 PM Changeset in webkit [197540] by Simon Fraser

13 edits in trunk/LayoutTests

Fix an image resource URL in tiled scrolling tests
https://bugs.webkit.org/show_bug.cgi?id=154981

Reviewed by Tim Horton.

These tests had an incorrect url to compositing/resources/simple_image.png.

tiled-drawing/scrolling/fixed-background/fixed-background-composited-expected.html:
tiled-drawing/scrolling/fixed-background/fixed-background-composited.html:
tiled-drawing/scrolling/fixed-background/fixed-background-negative-z-index-fixed-expected.html:
tiled-drawing/scrolling/fixed-background/fixed-background-negative-z-index-fixed.html:
tiled-drawing/scrolling/fixed-background/fixed-body-background-body-layer.html:
tiled-drawing/scrolling/fixed-background/fixed-body-background-opacity.html:
tiled-drawing/scrolling/fixed-background/fixed-body-background-positioned.html:
tiled-drawing/scrolling/fixed-background/fixed-body-background-transformed.html:
tiled-drawing/scrolling/fixed-background/fixed-body-background-zoomed.html:
tiled-drawing/scrolling/fixed-background/fixed-body-background.html:
tiled-drawing/scrolling/fixed-background/fixed-html-background.html:
tiled-drawing/scrolling/fixed-background/fixed-non-propagated-body-background.html:

6:25 PM Changeset in webkit [197539] by sbarati@apple.com

20 edits
1 add in trunk/Source/JavaScriptCore

Add Proxy tests for exceptions that depend on an object being non-extensible and having configurable properties
https://bugs.webkit.org/show_bug.cgi?id=154745

Reviewed by Geoffrey Garen.

This patch is mostly an implementation of Proxy.OwnPropertyKeys
with respect to section 9.5.11 of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys

This patch also changes call sites of getOwnPropertyNames and
getPropertyNames to expect that an exception can be thrown.

dfg/DFGOperations.cpp:
inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::iteratorEntries):

interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):

runtime/IntlObject.cpp:

(JSC::supportedLocales):

runtime/JSCJSValue.h:
runtime/JSCJSValueInlines.h:

(JSC::JSValue::get):
(JSC::JSValue::put):

runtime/JSONObject.cpp:

(JSC::Stringifier::Holder::appendNextProperty):
(JSC::Walker::walk):

runtime/JSObject.cpp:

(JSC::JSObject::getPropertyNames):
(JSC::JSObject::getGenericPropertyNames):

runtime/JSObject.h:

(JSC::makeIdentifier):
(JSC::createListFromArrayLike):

runtime/JSPropertyNameEnumerator.h:

(JSC::propertyNameEnumerator):

runtime/JSPropertyNameIterator.cpp:

(JSC::JSPropertyNameIterator::create):

runtime/MapConstructor.cpp:

(JSC::constructMap):

runtime/ObjectConstructor.cpp:

(JSC::defineProperties):
(JSC::objectConstructorSeal):
(JSC::objectConstructorFreeze):
(JSC::objectConstructorIsSealed):
(JSC::objectConstructorIsFrozen):
(JSC::ownPropertyKeys):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::getOwnPropertySlotByIndex):
(JSC::ProxyObject::deleteProperty):
(JSC::ProxyObject::deletePropertyByIndex):
(JSC::ProxyObject::defineOwnProperty):
(JSC::ProxyObject::performGetOwnPropertyNames):
(JSC::ProxyObject::getOwnPropertyNames):
(JSC::ProxyObject::getOwnNonIndexPropertyNames):
(JSC::ProxyObject::getStructurePropertyNames):
(JSC::ProxyObject::getGenericPropertyNames):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h:

(JSC::ProxyObject::create):
(JSC::ProxyObject::createStructure):

runtime/Structure.cpp:

(JSC::Structure::Structure):
(JSC::Structure::add):
(JSC::Structure::getPropertyNamesFromStructure):
(JSC::Structure::checkConsistency):
(JSC::Structure::canCachePropertyNameEnumerator):
(JSC::Structure::canAccessPropertiesQuicklyForEnumeration):
(JSC::Structure::canAccessPropertiesQuickly): Deleted.

runtime/Structure.h:
runtime/WeakMapConstructor.cpp:

(JSC::constructWeakMap):

tests/es6.yaml:
tests/stress/proxy-own-keys.js: Added.

(assert):
(throw.new.Error.let.handler.ownKeys):
(throw.new.Error):
(assert.let.handler.get ownKeys):
(assert.let.handler.ownKeys):
(let.handler.ownKeys):
(i.catch):
(shallowEq):
(let.handler.getOwnPropertyDescriptor):
(i.set assert):
(set add):
(set assert):
(set if):

5:58 PM Changeset in webkit [197538] by bshafiei@apple.com

5 edits in tags/Safari-602.1.21.0.1/Source

Versioning.

5:57 PM Changeset in webkit [197537] by timothy@apple.com

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Temporarily hide the TimelineSidebarPanel

https://bugs.webkit.org/show_bug.cgi?id=154974
rdar://problem/24956380

Reviewed by Joseph Pecoraro.

UserInterface/Views/TimelineTabContentView.js:

(WebInspector.TimelineTabContentView): Remove _showNavigationSidebarItem and hide the sidebar.

5:56 PM Changeset in webkit [197536] by keith_miller@apple.com

10 edits
2 adds in trunk

Array prototype JS builtins should support Symbol.species
https://bugs.webkit.org/show_bug.cgi?id=154710

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Add support for Symbol.species in the Array.prototype JS
builtin functions.

builtins/ArrayPrototype.js:

(filter):
(map):

runtime/ArrayConstructor.cpp:

(JSC::ArrayConstructor::finishCreation):
(JSC::arrayConstructorPrivateFuncIsArrayConstructor):

runtime/ArrayConstructor.h:

(JSC::ArrayConstructor::create):

runtime/CommonIdentifiers.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

tests/stress/array-species-functions.js:

(id):

LayoutTests:

Add test that checks the Array object created by a species
constructor in Array.prototype functions cannot come from a
different global object without subclassing.

js/array-species-different-globalobjects-expected.txt: Added.
js/array-species-different-globalobjects.html: Added.

5:56 PM Changeset in webkit [197535] by bshafiei@apple.com

1 copy in tags/Safari-602.1.21.0.1

New tag.

5:24 PM Changeset in webkit [197534] by msaboff@apple.com

12 edits in trunk

[ES6] Make Unicode RegExp pattern parsing conform to the spec
https://bugs.webkit.org/show_bug.cgi?id=154988

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

Updated RegExp pattern processing with 'u' (Unicode) flag to conform to the
spec (https://tc39.github.io/ecma262/2016/#sec-patterns). In the spec, the
grammar is annotated with [U] annotations. Productions that are prefixed with
[+U] are only available with the Unicode flags while productions prefixed with
[~U] are only available without the Unicode flag.

Added flags argument to Yarr::checkSyntax() so we can catch Unicode flag related
parsing errors at syntax checking time. Restricted what escapes are available for
non Unicode patterns. Most of this is defined in the IdentityEscape rule in the
pattern grammar.

Added \- as a CharacterClass only escape in Unicode patterns.

Updated the tests for these changes.

Made changes suggested in https://bugs.webkit.org/show_bug.cgi?id=154842#c22 after
change set r197426 was landed.

parser/ASTBuilder.h:

(JSC::ASTBuilder::createRegExp):

parser/Parser.cpp:

(JSC::Parser<LexerType>::parsePrimaryExpression):

parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createRegExp):

yarr/YarrInterpreter.cpp:

(JSC::Yarr::Interpreter::InputStream::readChecked):
(JSC::Yarr::Interpreter::InputStream::readSurrogatePairChecked):
(JSC::Yarr::Interpreter::InputStream::reread):
(JSC::Yarr::Interpreter::InputStream::uncheckInput):
(JSC::Yarr::Interpreter::InputStream::atStart):
(JSC::Yarr::Interpreter::InputStream::atEnd):
(JSC::Yarr::Interpreter::testCharacterClass):
(JSC::Yarr::Interpreter::backtrackPatternCharacter):
(JSC::Yarr::Interpreter::matchDisjunction):
(JSC::Yarr::ByteCompiler::atomPatternCharacter):

yarr/YarrParser.h:

(JSC::Yarr::Parser::Parser):
(JSC::Yarr::Parser::isIdentityEscapeAnError):
(JSC::Yarr::Parser::parseEscape):
(JSC::Yarr::Parser::parse):

yarr/YarrPattern.cpp:

(JSC::Yarr::CharacterClassConstructor::putChar):
(JSC::Yarr::CharacterClassConstructor::putRange):
(JSC::Yarr::CharacterClassConstructor::addSorted):
(JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):

yarr/YarrSyntaxChecker.cpp:

(JSC::Yarr::SyntaxChecker::disjunction):
(JSC::Yarr::checkSyntax):

yarr/YarrSyntaxChecker.h:

LayoutTests:

Added tests cases.

js/regexp-unicode-expected.txt:
js/script-tests/regexp-unicode.js:

(shouldThrowInvalidEscape):

[ES6] Add support for Symbol.toPrimitive
https://bugs.webkit.org/show_bug.cgi?id=154877

Reviewed by Saam Barati.

Update test for Symbol.toPrimitive.

js/Object-getOwnPropertyNames-expected.txt:
js/script-tests/Object-getOwnPropertyNames.js:

5:07 PM Changeset in webkit [197533] by sbarati@apple.com

6 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Implement Proxy.DefineOwnProperty
https://bugs.webkit.org/show_bug.cgi?id=154759

Reviewed by Geoffrey Garen and Mark Lam.

This patch is a straight forward implementation of Proxy.DefineOwnProperty
with respect to section 9.5.6 of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-defineownproperty-p-desc

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorGetOwnPropertyDescriptor):
(JSC::objectConstructorGetOwnPropertyDescriptors):

runtime/ObjectConstructor.h:

(JSC::constructEmptyObject):
(JSC::constructObjectFromPropertyDescriptor):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::isExtensible):
(JSC::ProxyObject::performDefineOwnProperty):
(JSC::ProxyObject::defineOwnProperty):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h:
tests/es6.yaml:
tests/stress/proxy-define-own-property.js: Added.

(assert):
(throw.new.Error):
(assert.let.handler.get defineProperty):
(assert.let.handler.defineProperty):
(let.handler.defineProperty):
(i.catch):
(assert.try.):
(assert.set get catch):
(assert.let.setter):
(assert.let.getter):
(assert.set get let.handler.defineProperty):
(assert.set get let):
(assert.):

4:54 PM Changeset in webkit [197532] by Gyuyoung Kim

4 edits in trunk/Source/WebKit2

Use std::make_unique<> when creating std::unique_ptr<>
https://bugs.webkit.org/show_bug.cgi?id=154574

Reviewed by Darin Adler.

NetworkProcess/cache/NetworkCacheStatistics.cpp:

(WebKit::NetworkCache::Statistics::open):

NetworkProcess/cache/NetworkCacheStatistics.h:
WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::createColorChooser):

4:47 PM Changeset in webkit [197531] by keith_miller@apple.com

22 edits
3 adds in trunk

[ES6] Add support for Symbol.toPrimitive
https://bugs.webkit.org/show_bug.cgi?id=154877

Reviewed by Saam Barati.

Source/JavaScriptCore:

This patch adds suport for Symbol.toPrimitive. Since we don't currently
generate snippits for one side of a binary operation we only need to change
the JSObject::ToPrimitive function and update some optimizations in the DFG
that need to know how conversions to primitive values should work. As of
ES6, the date prototype is also no longer special cased in the ToPrimitive
operation. Instead, Date.prototype has a Symbol.species function that
replicates the old behavior.

bytecode/ObjectPropertyConditionSet.cpp:

(JSC::generateConditionsForPropertyMissConcurrently):

bytecode/ObjectPropertyConditionSet.h:
dfg/DFGGraph.cpp:

(JSC::DFG::Graph::watchConditions):
(JSC::DFG::Graph::canOptimizeStringObjectAccess):

dfg/DFGGraph.h:
runtime/CommonIdentifiers.h:
runtime/DatePrototype.cpp:

(JSC::DatePrototype::finishCreation):
(JSC::dateProtoFuncToPrimitiveSymbol):

runtime/Error.cpp:

(JSC::throwTypeError):

runtime/Error.h:
runtime/JSCJSValueInlines.h:

(JSC::toPreferredPrimitiveType):

runtime/JSObject.cpp:

(JSC::callToPrimitiveFunction):
(JSC::JSObject::ordinaryToPrimitive):
(JSC::JSObject::defaultValue):
(JSC::JSObject::toPrimitive):
(JSC::JSObject::getPrimitiveNumber):
(JSC::callDefaultValueFunction): Deleted.
(JSC::throwTypeError): Deleted.

runtime/JSObject.h:

(JSC::JSObject::toPrimitive): Deleted.

runtime/SmallStrings.h:
runtime/SymbolPrototype.cpp:

(JSC::SymbolPrototype::finishCreation):

runtime/SymbolPrototype.h:

(JSC::SymbolPrototype::create):

tests/es6.yaml:
tests/stress/date-symbol-toprimitive.js: Added.
tests/stress/ropes-symbol-toprimitive.js: Added.

(ropify):
(String.prototype.Symbol.toPrimitive):

tests/stress/symbol-toprimitive.js: Added.

(foo.Symbol.toPrimitive):
(catch):

LayoutTests:

Update test for Symbol.toPrimitive.

js/Object-getOwnPropertyNames-expected.txt:
js/script-tests/Object-getOwnPropertyNames.js:

4:39 PM Changeset in webkit [197530] by Matt Baker

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Selected range path component should be zero time corrected
https://bugs.webkit.org/show_bug.cgi?id=154950
<rdar://problem/24947022>

Reviewed by Timothy Hatcher.

Subtracts zero time from TimelineRange start and end values, and corrects
a cosmetic issue in TimelineRuler which showed selection handle tooltips
that weren't adjusted for the ruler's zero time.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView.prototype._timeRangeSelectionChanged):

UserInterface/Views/TimelineRuler.js:

(WebInspector.TimelineRuler.prototype._updateSelection):

4:33 PM Changeset in webkit [197529] by Matt Baker

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Events and Frames mode switch does not fully switch until first zoom
https://bugs.webkit.org/show_bug.cgi?id=154971
<rdar://problem/24955871>

Reviewed by Timothy Hatcher.

Switching modes toggles the visibility of the tree outline, which changes
the width of the overview's ruler, graphs, and scroll container. When the
view mode changes, the overview needs a forced "resize" layout.

UserInterface/Views/TimelineOverview.js:

(WebInspector.TimelineOverview.prototype._viewModeDidChange):

4:28 PM Changeset in webkit [197528] by rniwa@webkit.org

9 edits
4 adds in trunk

Source/WebCore:
Disallow custom elements inside a window-less documents
https://bugs.webkit.org/show_bug.cgi?id=154944
<rdar://problem/24944875>

Reviewed by Antti Koivisto.

Disallow custom elements inside a window-less documents such as the shared inert document of template elements
and the ones created by DOMImplementation.createDocument and DOMImplementation.createHTMLDocument.

Throw NotSupportedError in defineCustomElement when it's called in such a document as discussed in:
https://github.com/w3c/webcomponents/issues/369

Tests: fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html

fast/custom-elements/parser/parser-uses-registry-of-owner-document.html

bindings/js/JSDOMBinding.cpp:

(WebCore::throwNotSupportedError): Added.

bindings/js/JSDOMBinding.h:
bindings/js/JSDocumentCustom.cpp:

(WebCore::JSDocument::defineCustomElement): Throw NotSupportedError when the context object's document doesn't
have a browsing context (i.e. window-less).

html/parser/HTMLDocumentParser.cpp:

(WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Replaced a FIXME with an assertion now that we
disallow instantiation of custom elements inside a template element.

LayoutTests:
Disallow custom elements inside template elements and share the registry for windowless documents
https://bugs.webkit.org/show_bug.cgi?id=154944
<rdar://problem/24944875>

Reviewed by Antti Koivisto.

Added various tests to ensure the custom elements registry is not shared between documents with
distinct browsing context (e.g. iframes) but shared among the ones that share a single browsing context
(e.g. documents created by DOMImplementation).

Also added a test case for defineCustomElement to ensure it throws NotSupportedError when it's called on
a template element's inert owner document as well as a basic test case for document.write.

fast/custom-elements/Document-defineCustomElement-expected.txt:
fast/custom-elements/Document-defineCustomElement.html: Added a new test case.
fast/custom-elements/parser/parser-constructs-custom-element-in-document-write-expected.txt: Added.
fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html: Added.
fast/custom-elements/parser/parser-uses-registry-of-owner-document-expected.txt: Added.
fast/custom-elements/parser/parser-uses-registry-of-owner-document.html: Added.

4:26 PM Changeset in webkit [197527] by achristensen@apple.com

4 edits in trunk/Source

Move SPI to CFNetworkSPI.h
https://bugs.webkit.org/show_bug.cgi?id=154992

Reviewed by Andy Estes.

Source/WebCore:

platform/spi/cf/CFNetworkSPI.h:

Source/WebKit2:

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::applyBasicAuthorizationHeader):

4:21 PM Changeset in webkit [197526] by achristensen@apple.com

11 edits in trunk/Source

Use CredentialStorage with NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154939

Reviewed by Darin Adler.

Source/WebCore:

This makes the credential-based http tests pass when using NetworkSession.

platform/network/CredentialBase.h:

(WebCore::CredentialBase::encodingRequiresPlatformData):

platform/network/CredentialStorage.h:

WEBCORE_EXPORT more things that are newly used in WebKit2.

Source/WebKit2:

config.h:

Added compile-time flag to help us be able to keep track and remove this code when we can.

NetworkProcess/NetworkDataTask.h:

(WebKit::NetworkDataTask::pendingDownloadLocation):

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::clearCachedCredentials):
(WebKit::NetworkProcess::ensurePrivateBrowsingSession):

NetworkProcess/NetworkSession.h:

(WebKit::NetworkSession::sessionID):

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::applyBasicAuthorizationHeader):
(WebKit::NetworkDataTask::NetworkDataTask):
Use a credential storage and preemptively apply basic authentication headers if we have credentials from the storage.
This is analogous to code in ResourceHandle::createNSURLConnection.

(WebKit::NetworkDataTask::didReceiveChallenge):
Make this look more like ResourceHandle::didReceiveAuthenticationChallenge.
The call to tryPasswordBasedAuthentication was moved from the delegate callback to here.

(WebKit::NetworkDataTask::willPerformHTTPRedirection):
Use credentials from the credential storage if they exist. This is analogous to code in ResourceHandle::willSendRequest.

(WebKit::NetworkDataTask::tryPasswordBasedAuthentication):
Use credentials from the credential storage if they exist. This is analogous to code in ResourceHandle::tryHandlePasswordBasedAuthentication.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
If we are given a credential with CredentialPersistenceForSession, put it in the credential storage and give
CFNetwork a credential with CredentialPersistenceNone so it won't automatically be used again until the credential
storage says its ok to use again. This gives us the ability to clear session credentials when logout credentials are used.
This is analogous to code in ResourceHandle::receivedCredential.

(WebKit::NetworkSession::defaultSession):
(WebKit::NetworkSession::NetworkSession):
(WebKit::NetworkSession::~NetworkSession):
(WebKit::NetworkSession::dataTaskForIdentifier):
(WebKit::NetworkSession::clearCredentials): Deleted.

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::clearCachedCredentials):
(WebKit::WebProcess::focusedWebPage):
We no longer need to clear credentials from the NSURLSessions because we don't store session credentials in them.
Instead, calling CredentialStorage.clearCredentials is sufficient.

3:57 PM Changeset in webkit [197525] by clopez@igalia.com

2 edits in trunk/Tools

[GTK] Unreviewed fix after r197505 (Run the run-benchmark script on the performance bot.)
https://bugs.webkit.org/show_bug.cgi?id=154595

Unreviewed fix after r197505.

BuildSlaveSupport/build.webkit.org-config/master.cfg:

(RunBenchmarkTests.start):

3:55 PM Changeset in webkit [197524] by Alan Bujtas

3 edits
2 adds in trunk

Subpixel rendering: Make collapsed borders painting subpixel aware.
https://bugs.webkit.org/show_bug.cgi?id=154980

Reviewed by David Hyatt.

This patch enables collapsed borders with odd pixel width paint on subpixel position.
Currently borders with odd pixels are split at integral position so that border-width: 3px;
paints 1px on the left(top) and 2px on the right(bottom) side. With this patch
we paint 1.5px on both sides(on 2x display).

Source/WebCore:

Test: fast/table/hidpi-collapsed-border-with-odd-pixel-width.html

rendering/RenderTableCell.cpp:

(WebCore::RenderTableCell::paintCollapsedBorders):

LayoutTests:

fast/table/hidpi-collapsed-border-with-odd-pixel-width-expected.html: Added.
fast/table/hidpi-collapsed-border-with-odd-pixel-width.html: Added.

3:49 PM Changeset in webkit [197523] by dbates@webkit.org

6 edits
1 add in trunk

Add unit tests for WTF::OptionSet
https://bugs.webkit.org/show_bug.cgi?id=154925
<rdar://problem/24964211>

Reviewed by Darin Adler.

Source/WTF:

wtf/CMakeLists.txt: Add header OptionSet.h to the list of WTF headers.
wtf/OptionSet.h: Use in-class initialization to initialize m_storage and declare

the trivial constexpr constructor as default.
(WTF::OptionSet::OptionSet): For convenience add a constructor that takes a std::initializer_list.
This code was written by Anders Carlsson.

Tools:

Add tests to ensure that we do not regress the behavior of WTF::OptionSet.

TestWebKitAPI/CMakeLists.txt: Add file TestWebKitAPI/Tests/WTF/OptionSet.cpp.
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Ditto.
TestWebKitAPI/Tests/WTF/OptionSet.cpp: Added.

(TestWebKitAPI::TEST):

3:42 PM Changeset in webkit [197522] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/Tools

Merge r188607. rdar://problem/24937998

3:32 PM Changeset in webkit [197521] by bshafiei@apple.com

2 edits in tags/Safari-602.1.21/Source/WebCore

Roll out r197149.

3:30 PM Changeset in webkit [197520] by fpizlo@apple.com

8 edits
3 adds in trunk

DFG should be able to compile StringReplace
https://bugs.webkit.org/show_bug.cgi?id=154979

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

Adds support for StringReplace to the DFG tier. This is a 3% speed-up on Octane/regexp.

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculateFinalObject):
(JSC::DFG::SpeculativeJIT::speculateRegExpObject):
(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

jit/JITOperations.h:

LayoutTests:

Add a microbenchmark for a case of StringReplace that we hadn't covered with a microbenchmark
yet: using something absurd for the replace value. This is interesting for implementing the
32_64 version of StringReplace, which gets really weird in the absurd case because of how it
consumes the entire register file while making the call on x86-32.

js/regress/script-tests/string-replace-generic.js: Added.
js/regress/string-replace-generic-expected.txt: Added.
js/regress/string-replace-generic.html: Added.

1:49 PM Changeset in webkit [197519] by hyatt@apple.com

7 edits
10 adds in trunk

Add support for the "last" value of hanging-punctuation
https://bugs.webkit.org/show_bug.cgi?id=154977

Reviewed by Darin Adler and Simon Fraser.

Source/WebCore:

New tests in fast/text.

This patch adds support for the new "last" value and also fixes up both
"first" and "last" to work with leading and trailing whitespace that ends
up getting collapsed away.

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):

rendering/RenderBlockLineLayout.cpp:

(WebCore::inlineAncestorHasStartBorderPaddingOrMargin):
(WebCore::inlineAncestorHasEndBorderPaddingOrMargin):
(WebCore::isLastInFlowRun):
(WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):

rendering/RenderText.cpp:

(WebCore::isHangablePunctuationAtLineEnd):
(WebCore::RenderText::hangablePunctuationStartWidth):
(WebCore::RenderText::hangablePunctuationEndWidth):
(WebCore::RenderText::firstCharacterIndexStrippingSpaces):
(WebCore::RenderText::lastCharacterIndexStrippingSpaces):
(WebCore::RenderText::trimmedPrefWidths):

rendering/RenderText.h:
rendering/line/BreakingContext.h:

(WebCore::BreakingContext::handleText):

LayoutTests:

fast/text/hanging-punctuation-first-and-last-together-expected.html: Added.
fast/text/hanging-punctuation-first-and-last-together.html: Added.
fast/text/hanging-punctuation-first-ws-expected.html: Added.
fast/text/hanging-punctuation-first-ws.html: Added.
fast/text/hanging-punctuation-last-expected.html: Added.
fast/text/hanging-punctuation-last-rtl-expected.html: Added.
fast/text/hanging-punctuation-last-rtl.html: Added.
fast/text/hanging-punctuation-last-ws-expected.html: Added.
fast/text/hanging-punctuation-last-ws.html: Added.
fast/text/hanging-punctuation-last.html: Added.

1:46 PM Changeset in webkit [197518] by aestes@apple.com

12 edits in trunk/Source

Adopt CFNetwork storage partitioning SPI
https://bugs.webkit.org/show_bug.cgi?id=154957
rdar://problem/23614620

Reviewed by Darin Adler.

Source/WebCore:

Adopt CFNetwork SPI for creating storage partitions. If Settings::cookieStoragePartitioningEnabled() is true,
create cookie storage partitions for third-party contexts. This feature is disabled by default.

No new tests. Test support is tracked by <https://webkit.org/b/154958>.

page/Settings.cpp:

(WebCore::Settings::setCookieStoragePartitioningEnabled): Controls whether storage partitioning for cookies is enabled.

page/Settings.h:

(WebCore::Settings::cookieStoragePartitioningEnabled):

platform/network/NetworkStorageSession.h:
platform/network/cf/NetworkStorageSessionCFNet.cpp:

(WebCore::cookieStoragePartition): Computes a storage partition identifier by determining the top
privately-controlled domain of the cookie's first-party (main frame document) URL, then determining whether the
cookie's document hostname is a subdomain of it. If is is not, the first-party top domain is the partition name.
Otherwise, there is no partition name.

platform/network/mac/CookieJarMac.mm:

(WebCore::applyPartitionToCookies): Returns a deep copy of the given cookie array after adding a storage
partition property to each copied cookie.
(WebCore::cookiesInPartitionForURL): Returns cookies for the partition computed by the given URLs. If no
partition can be determined, nil is returned.
(WebCore::cookiesForURL): Returns cookiesInPartitionForURL() if non-nil, otherwise returns wkHTTPCookiesForURL().
(WebCore::cookiesForSession): Started calling cookiesForURL().
(WebCore::setCookiesFromDOM): Called applyPartitionToCookies() if a partition can be computed from the given URLs.
(WebCore::getRawCookies): Started calling cookiesForURL().

platform/network/mac/ResourceHandleMac.mm:

(WebCore::ResourceHandle::createNSURLConnection): Computed the storage partition identifier for the new request.
If non-empty, set it as a property on the NSURLRequest where CFNetwork knows to find it.

platform/spi/cf/CFNetworkSPI.h: Declare new SPI for building with the public SDK.

Source/WebKit2:

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::NetworkDataTask): Computed the storage partition identifier for the new session task.
If non-empty, set it using a NSURLSessionTask SPI.

Source/WTF:

wtf/Platform.h: Defined HAVE_CFNETWORK_STORAGE_PARTITIONING.

1:43 PM Changeset in webkit [197517] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/LayoutTests

Merge r195688. None

1:25 PM Changeset in webkit [197516] by commit-queue@webkit.org

8 edits in trunk/Source/WebKit2

[WK2] testRunner.setPrivateBrowsingEnabled doesn't work with NetworkProcess
https://bugs.webkit.org/show_bug.cgi?id=115274

Patch by Alex Christensen <achristensen@webkit.org> on 2016-03-03
Reviewed by Darin Adler.

NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::blobSize):
(WebKit::NetworkConnectionToWebProcess::ensureLegacyPrivateBrowsingSession):

NetworkProcess/NetworkConnectionToWebProcess.h:
NetworkProcess/NetworkConnectionToWebProcess.messages.in:
NetworkProcess/NetworkProcess.h:
WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::setPrivateBrowsingEnabled):

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::destroyPrivateBrowsingSession):
(WebKit::WebProcess::ensureLegacyPrivateBrowsingSessionInNetworkProcess):
(WebKit::WebProcess::pluginProcessConnectionManager):

WebProcess/WebProcess.h:

12:34 PM Changeset in webkit [197515] by Matt Baker

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Assertion Failed: Cannot show timeline because it does not belong to the shown recording. – "overview"
https://bugs.webkit.org/show_bug.cgi?id=154972
<rdar://problem/24956233>

Reviewed by Timothy Hatcher.

UserInterface/Views/TimelineTabContentView.js:

(WebInspector.TimelineTabContentView.prototype._showTimelineViewForType):
Just show the overview if the recording has no timeline of the given type.

12:26 PM Changeset in webkit [197514] by jonlee@apple.com

3 edits
13 adds in trunk/PerformanceTests

Update image test
https://bugs.webkit.org/show_bug.cgi?id=154962

Rubber-stamped by Darin Adler.

Animometer/tests/master/image-data.html: Make each canvas have a compositing layer.
Animometer/tests/master/resources/image-data.js:

(initialize): Update to load multiple images serially.
(_loadImage):
(tune): Use display instead of visibility. When showing an element anew, move it somewhere else.
(_createTestElement): Set up the element, refactor out placement of element to _refreshElement.
(_refreshElement): Place element in a tile grid.
(animate):
(_getRandomNeighboringPixelIndex): Use a more conservative distribution to make the effect last a little longer.

Animometer/tests/master/resources/compass.svg: Added.
Animometer/tests/master/resources/console.svg: Added.
Animometer/tests/master/resources/contribute.svg: Added.
Animometer/tests/master/resources/debugger.svg: Added.
Animometer/tests/master/resources/inspector.svg: Added.
Animometer/tests/master/resources/layout.svg: Added.
Animometer/tests/master/resources/performance.svg: Added.
Animometer/tests/master/resources/script.svg: Added.
Animometer/tests/master/resources/shortcuts.svg: Added.
Animometer/tests/master/resources/standards.svg: Added.
Animometer/tests/master/resources/storage.svg: Added.
Animometer/tests/master/resources/styles.svg: Added.
Animometer/tests/master/resources/timeline.svg: Added.

11:46 AM Changeset in webkit [197513] by beidson@apple.com

4 edits in trunk/LayoutTests

storage/indexeddb/delete-in-upgradeneeded-close-in-open-success.html flaky on mac-wk2.
https://bugs.webkit.org/show_bug.cgi?id=154747

Reviewed by Alex Christensen.

This callback coming out of order like this is okay, so the test should just allow it.

It makes sense that the flake is WK2-only, since WK1 has a much more well defined order
with thread-hopping versus process-hopping.

storage/indexeddb/delete-in-upgradeneeded-close-in-open-success-expected.txt:
storage/indexeddb/delete-in-upgradeneeded-close-in-open-success-private-expected.txt:
storage/indexeddb/resources/delete-in-upgradeneeded-close-in-open-success.js:

11:18 AM Changeset in webkit [197512] by sbarati@apple.com

9 edits in trunk/Source/JavaScriptCore

SetPrototypeOf isn't properly implemented everywhere
https://bugs.webkit.org/show_bug.cgi?id=154943

Reviewed by Benjamin Poulain.

We were copy-pasting implememntation bits that belong in OrdinarySetPrototypeOf
in a few different places that call O.SetPrototypeOf(v)
rather than having those bits in OrdinarySetPrototypeOf itself.
We need to put those copy-pasted bits into OrdinarySetPrototypeOf
and not the call sites of O.SetPrototypeOf(v) because
O.SetPrototypeOf(v) won't always call into OrdinarySetPrototypeOf.
This is needed for correctness because this behavior is now observable
with the ES6 Proxy object.

runtime/ClassInfo.h:
runtime/JSCell.cpp:

(JSC::JSCell::isExtensible):
(JSC::JSCell::setPrototype):

runtime/JSCell.h:
runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoSetter):

runtime/JSObject.cpp:

(JSC::JSObject::setPrototypeDirect):
(JSC::JSObject::setPrototypeWithCycleCheck):
(JSC::JSObject::setPrototype):
(JSC::JSObject::allowsAccessFrom):

runtime/JSObject.h:

(JSC::JSObject::mayInterceptIndexedAccesses):

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorSetPrototypeOf):

runtime/ReflectObject.cpp:

(JSC::reflectObjectSetPrototypeOf):

10:34 AM Changeset in webkit [197511] by Manuel Rego Casasnovas

2 edits in trunk/Source/WebCore

[css-grid] Fix order of grid shorthands in CSSPropertyNames.in
https://bugs.webkit.org/show_bug.cgi?id=154915

Reviewed by Darin Adler.

The order of columns and rows in grid and grid-template shorthands
has been swapped recently (r196906 & r196934).
However the order was not updated in CSSPropertyNames.in file.

css/CSSPropertyNames.in:

10:30 AM Changeset in webkit [197510] by beidson@apple.com

2 edits in trunk/LayoutTests

storage/indexeddb/intversion-open-in-upgradeneeded.html is flaky on mac-wk2 debug.
https://bugs.webkit.org/show_bug.cgi?id=154706

Rubberstamped by Alex Christensen.

This test was fixed by http://trac.webkit.org/changeset/197474.

Unskipping it now.

platform/mac-wk2/TestExpectations:

9:40 AM Changeset in webkit [197509] by ap@apple.com

3 edits in trunk/Source/WebCore

AllInOne build fix.

rendering/RenderFlexibleBox.cpp:
rendering/RenderGrid.cpp:

Don't have two static functions with the same name.

9:28 AM Changeset in webkit [197508] by commit-queue@webkit.org

2 edits in trunk/Tools

Unreviewed, rolling out r197442.
https://bugs.webkit.org/show_bug.cgi?id=154967

Broke tests, and also uses a wrong approach (Requested by ap
on #webkit).

Reverted changeset:

"Disable FTL JIT testing on 32-bit JSC tester bots"
https://bugs.webkit.org/show_bug.cgi?id=154858
http://trac.webkit.org/changeset/197442

9:25 AM Changeset in webkit [197507] by Chris Dumez

15 edits in trunk

Drop [TreatNullAs=EmptyString] from URL interface attributes
https://bugs.webkit.org/show_bug.cgi?id=154951

Reviewed by Darin Adler.

Source/WebCore:

Drop [TreatNullAs=EmptyString] from URL interface attributes to match
the specification:

https://url.spec.whatwg.org/#api

Firefox and Chrome both already follow the specification and convert
null to the "null" string.

No new tests, already covered by existing tests.

html/URLUtils.idl:

LayoutTests:

Update existing tests now that URL interface attributes no longer treat
null as the empty string.

fast/dom/DOMURL/set-href-attribute-hash-expected.txt:
fast/dom/DOMURL/set-href-attribute-hash.html:
fast/dom/DOMURL/set-href-attribute-host-expected.txt:
fast/dom/DOMURL/set-href-attribute-host.html:
fast/dom/DOMURL/set-href-attribute-hostname-expected.txt:
fast/dom/DOMURL/set-href-attribute-hostname.html:
fast/dom/DOMURL/set-href-attribute-pathname-expected.txt:
fast/dom/DOMURL/set-href-attribute-pathname.html:
fast/dom/DOMURL/set-href-attribute-protocol-expected.txt:
fast/dom/DOMURL/set-href-attribute-protocol.html:
fast/dom/DOMURL/set-href-attribute-search-expected.txt:
fast/dom/DOMURL/set-href-attribute-search.html:

9:09 AM Changeset in webkit [197506] by commit-queue@webkit.org

8 edits in trunk/Source/WebCore

[TextureMapper] Use RGBA format for textures attached to framebuffers
https://bugs.webkit.org/show_bug.cgi?id=154965

Patch by Miguel Gomez <magomez@igalia.com> on 2016-03-03
Reviewed by Žan Doberšek.

Use RGBA format when allocating textures that will be used as framebuffer
attachments. This means adding a new flag to BitmapTexture and modifying
BitmapTextureGL to use the appropriate format according to the flag. Also,
BitmapTexturePool needs to use two vectors to handle both types of textures
separately, as we want to avoid constantly switching the format of a reused
texture.

No new tests since the behavior change is covered by existing tests.

platform/graphics/texmap/BitmapTexture.h: Add new flag.
platform/graphics/texmap/BitmapTextureGL.cpp:

(WebCore::BitmapTextureGL::BitmapTextureGL): Receive flags on constructor and use RGBA
when the FBOAttachment flag is enabled.
(WebCore::BitmapTextureGL::applyFilters): Use FBOAttachemt flag to request a texture.

platform/graphics/texmap/BitmapTextureGL.h: Add flags to the constructor.
platform/graphics/texmap/BitmapTexturePool.cpp: Add a new vector of textures to hold

those in RGBA format.
(WebCore::BitmapTexturePool::acquireTexture): Return a texture for the usage specified
in the incoming flags.
(WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired): Release textures from
both vectors.
(WebCore::BitmapTexturePool::createTexture): Pass the usage flag when creating a new
texture.

platform/graphics/texmap/BitmapTexturePool.h: Add new texture vector and add flags to

the needed headers.

platform/graphics/texmap/TextureMapper.cpp:

(WebCore::TextureMapper::acquireTextureFromPool): Pass the received flags to the BitmapTexturePool.

platform/graphics/texmap/TextureMapperLayer.cpp:

(WebCore::TextureMapperLayer::paintIntoSurface): Use FBOAttachemt flag to request a texture.

8:40 AM Changeset in webkit [197505] by clopez@igalia.com

6 edits in trunk/Tools

[GTK] Run the run-benchmark script on the performance bot.
https://bugs.webkit.org/show_bug.cgi?id=154595

Reviewed by Carlos Garcia Campos.

BuildSlaveSupport/build.webkit.org-config/master.cfg: Add new RunBenchmarkTests step on the perf bots (only for the GTK+ port at this moment).

(RunBenchmarkTests):
(RunBenchmarkTests.start):
(RunBenchmarkTests.getText):
(RunBenchmarkTests.getText2):
(BuildAndPerfTestFactory.init):
(DownloadAndPerfTestFactory.init):

BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py: Add new test for RunBenchmarkTests and update expected steps of GTK+ perf bot.

(RunBenchmarkTest):
(RunBenchmarkTest.assertResults):
(RunBenchmarkTest.test_success):
(RunBenchmarkTest.test_tests_failed):

Scripts/webkitpy/benchmark_runner/benchmark_runner.py: Log both the current iteration as also the total iterations for the current benchmark/plan.

(BenchmarkRunner._run_benchmark):

Scripts/webkitpy/benchmark_runner/browser_driver/gtk_minibrowser_driver.py: Use python logging also for errors.

(GTKMiniBrowserDriver.close_browsers):

Scripts/webkitpy/benchmark_runner/run_benchmark.py: Implement support for running all available benchmark plans.

(parse_args):
(start):
(main):

6:59 AM WebKitGTK/2.4.x edited by tpopela@redhat.com

(diff)

6:09 AM Changeset in webkit [197504] by Gyuyoung Kim

3 edits in trunk/Tools

[EFL] Remove u-szeged.hu SVN mirror in EFL perf bot
https://bugs.webkit.org/show_bug.cgi?id=154960

Reviewed by Csaba Osztrogonác.

BuildSlaveSupport/build.webkit.org-config/config.json: Remove szeged univ's svn mirror.
BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py:

4:15 AM WebKitGTK/2.4.x edited by berto@igalia.com

(diff)

4:05 AM WebKitGTK/2.4.x edited by berto@igalia.com

(diff)

4:00 AM WebKitGTK/2.4.x edited by berto@igalia.com

(diff)

3:05 AM Changeset in webkit [197503] by jfernandez@igalia.com

57 edits in trunk

[CSS Box Alignment] New CSS Value 'normal' for Content Alignment
https://bugs.webkit.org/show_bug.cgi?id=154282

Source/WebCore:

Reviewed by David Hyatt.

The Box Alignment specification defines a new value 'normal' to be used
as default for the different layout models, which will define the
specific behavior for each case. This patch adds a new CSS value in the
parsing logic and adapts the Content Alignment properties to the new
value.

The 'auto' value is no longer valid and the Computed Value will be
always the specified value. Hence, I removed the StyleResolver logic
because is not required now; the specific behavior of the 'normal'
value will be resolved at layout time.

Computed value of both align-content and justify-content is the
specified value, we don't have to resolve any 'auto' value now.

Additionally, this patch updates the layout logic as well, for both
Flexbox and Grid layout models.

No new tests, since we only need to rebaseline those test cases
affected by the new default computed value.

css/CSSComputedStyleDeclaration.cpp:

(WebCore::valueForContentPositionAndDistributionWithOverflowAlignment):
(WebCore::ComputedStyleExtractor::propertyValue):
(WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Deleted.
(WebCore::CSSComputedStyleDeclaration::copyProperties): Deleted.
(WebCore::nodeOrItsAncestorNeedsStyleRecalc): Deleted.
(WebCore::isFlexOrGrid): Deleted.
(WebCore::ComputedStyleExtractor::customPropertyValue): Deleted.

css/CSSParser.cpp:

(WebCore::CSSParser::parseContentDistributionOverflowPosition):

css/CSSPrimitiveValueMappings.h:

(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator ContentPosition):

rendering/RenderFlexibleBox.cpp:

(WebCore::normalValueBehavior):
(WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
(WebCore::RenderFlexibleBox::layoutColumnReverse):
(WebCore::RenderFlexibleBox::alignFlexLines):
(WebCore::alignContentSpaceBetweenChildren): Deleted.

rendering/RenderGrid.cpp:

(WebCore::normalValueBehavior):
(WebCore::RenderGrid::applyStretchAlignmentToTracksIfNeeded):
(WebCore::RenderGrid::columnAxisOffsetForChild):
(WebCore::RenderGrid::rowAxisOffsetForChild):
(WebCore::resolveContentDistributionFallback):
(WebCore::contentDistributionOffset):
(WebCore::RenderGrid::computeContentPositionAndDistributionOffset):

rendering/style/RenderStyle.cpp:

(WebCore::resolvedContentAlignmentPosition):
(WebCore::resolvedContentAlignmentDistribution):
(WebCore::RenderStyle::resolvedJustifyContentPosition):
(WebCore::RenderStyle::resolvedJustifyContentDistribution):
(WebCore::RenderStyle::resolvedAlignContentPosition):
(WebCore::RenderStyle::resolvedAlignContentDistribution):

rendering/style/RenderStyle.h:
rendering/style/RenderStyleConstants.h:

LayoutTests:

Since the 'normal' vlaue, initial/default for both justify-content
and align-content CSS properties, behaves now as 'stretch' instead
of o'start' we have to rebaseline those tests affected by the new
default value.

Reviewed by David Hyatt.

css3/flexbox/css-properties-expected.txt:
css3/flexbox/css-properties.html:
css3/parse-align-content-expected.txt:
css3/parse-align-content.html:
css3/parse-justify-content-expected.txt:
css3/parse-justify-content.html:
css3/resources/alignment-parsing-utils.js:

(checkBadValues):

fast/css-grid-layout/auto-content-resolution-columns.html:
fast/css-grid-layout/grid-auto-columns-rows-update.html:
fast/css-grid-layout/grid-auto-flow-resolution.html:
fast/css-grid-layout/grid-columns-rows-get-set-multiple.html:
fast/css-grid-layout/grid-columns-rows-get-set.html:
fast/css-grid-layout/grid-container-change-named-grid-lines-recompute-child.html:
fast/css-grid-layout/grid-content-sized-columns-resolution.html:
fast/css-grid-layout/grid-dynamic-updates-relayout.html:
fast/css-grid-layout/grid-element-min-max-width.html:
fast/css-grid-layout/grid-element-repeat-get-set.html:
fast/css-grid-layout/grid-initialize-span-one-items.html:
fast/css-grid-layout/grid-item-addition-auto-placement-update.html:
fast/css-grid-layout/grid-item-addition-track-breadth-update.html:
fast/css-grid-layout/grid-item-bad-named-area-auto-placement.html:
fast/css-grid-layout/grid-item-margin-auto-columns-rows-horizontal-ltr.html:
fast/css-grid-layout/grid-item-margin-auto-columns-rows-horizontal-rtl.html:
fast/css-grid-layout/grid-item-margin-auto-columns-rows-vertical-ltr.html:
fast/css-grid-layout/grid-item-margin-auto-columns-rows-vertical-rtl.html:
fast/css-grid-layout/grid-item-multiple-minmax-content-resolution.html:
fast/css-grid-layout/grid-item-named-grid-area-resolution.html:
fast/css-grid-layout/grid-item-negative-indexes.html:
fast/css-grid-layout/grid-item-order-in-content-sized-columns-resolution.html:
fast/css-grid-layout/grid-item-removal-auto-placement-update.html:
fast/css-grid-layout/grid-item-removal-track-breadth-update.html:
fast/css-grid-layout/grid-update-sizes-after-distributing-all.html:
fast/css-grid-layout/implicit-columns-auto-resolution.html:
fast/css-grid-layout/implicit-position-dynamic-change.html:
fast/css-grid-layout/mark-as-infinitely-growable.html:
fast/css-grid-layout/maximize-tracks-definite-indefinite-width.html:
fast/css-grid-layout/minmax-spanning-resolution-columns.html:
fast/css-grid-layout/named-grid-line-get-set.html:
fast/css-grid-layout/named-grid-lines-computed-style-implicit-tracks.html:
fast/css-grid-layout/named-grid-lines-with-named-grid-areas-resolution.html:
fast/css-grid-layout/percent-intrinsic-track-breadth.html:
fast/css-grid-layout/percent-track-breadths-regarding-container-size.html:
fast/css-grid-layout/resources/grid-definitions-parsing-utils.js:

(checkGridTemplatesSetJSValues):

fast/css-grid-layout/resources/grid-template-shorthand-parsing-utils.js:

(checkGridDefinitionsSetJSValues):
(testGridDefinitionsSetBadJSValues):

fast/css/getComputedStyle/computed-style-expected.txt:
fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
svg/css/getComputedStyle-basic-expected.txt:

2:53 AM WebKitGTK/2.4.x edited by tpopela@redhat.com

(diff)

2:48 AM Changeset in webkit [197502] by Antti Koivisto

3 edits in trunk/Source/WebCore

Slider thumb style should not depend on renderers
https://bugs.webkit.org/show_bug.cgi?id=154961

Reviewed by Andreas Kling.

Currently slider thumb pseudo id is computed based on host element renderer.
Style is the input for building a render tree and should be computable without having one.

html/shadow/SliderThumbElement.cpp:

(WebCore::SliderThumbElement::hostInput):
(WebCore::SliderThumbElement::customStyleForRenderer):

Compute pseudo id based on the host style.
Return nullptr so style recalc will otherwise proceed normally.

(WebCore::SliderThumbElement::shadowPseudoId):
(WebCore::SliderThumbElement::cloneElementWithoutAttributesAndChildren):
(WebCore::SliderContainerElement::SliderContainerElement):
(WebCore::SliderContainerElement::create):
(WebCore::SliderContainerElement::createElementRenderer):
(WebCore::SliderContainerElement::customStyleForRenderer):

Here too.

(WebCore::SliderContainerElement::shadowPseudoId):
(WebCore::sliderThumbShadowPseudoId): Deleted.
(WebCore::mediaSliderThumbShadowPseudoId): Deleted.

html/shadow/SliderThumbElement.h:

2:23 AM Changeset in webkit [197501] by Manuel Rego Casasnovas

4 edits in trunk/Source/WebCore

[css-grid] Simplify method to resolve auto-placed items
https://bugs.webkit.org/show_bug.cgi?id=154911

Reviewed by Sergio Villar Senin.

Refactor the method to resolve auto-placed items
as we're only interested in knowing the span size.

Adapt the calls to use the span size instead of a GridSpan.

No new tests, no change of behavior.

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
(WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
(WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):

rendering/style/GridResolvedPosition.cpp:

(WebCore::GridResolvedPosition::spanSizeForAutoPlacedItem):
(WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
Renamed to spanSizeForAutoPlacedItem().

rendering/style/GridResolvedPosition.h:

1:12 AM Changeset in webkit [197500] by achristensen@apple.com

2 edits in trunk/Source/JavaScriptCore

Fix Windows build after r197489.

jsc.cpp:

12:22 AM Changeset in webkit [197499] by jonlee@apple.com

4 edits in trunk/PerformanceTests

Add some new controllers, and refine tests
https://bugs.webkit.org/show_bug.cgi?id=154914

Reviewed by Simon Fraser.

Improve tests.

Animometer/tests/master/focus.html: Move each particle into a layer. Put the particle

in a container element. Expand the container element by the max blur radius, and clip
overflow. This way, when the blur is applied, it avoids causing layer resizes.

Animometer/tests/master/resources/focus.js:

(FocusElement.Utilities.createClass): Create a container element, and put the particle
inside.
(hide): Set display:none.
(show): Set display:block.
(animate): Apply filters to the container element.
(FocusStage.call.initialize): Instead of inserting and removing elements from the DOM,
keep them in the stage, but set the display style instead. Use this._offsetIndex to
keep track of which elements are displayed.
(FocusStage.call.animate): Move some calculations around to avoid doing unneeded math.
(FocusStage.call.getBlurValue): Make sure elements are always blurred.
(FocusStage.call.getOpacityValue): Make sure elements have some opacity.

Animometer/tests/master/resources/multiply.js: Have the particles on the edge of the

stage appear less black when the complexity gets large enough.
(tune): Have this._distanceFactor calculate the factor. Avoid calculating square root each
frame.

12:15 AM Changeset in webkit [197498] by jonlee@apple.com

7 edits in trunk/PerformanceTests

Add some new controllers, and refine tests
https://bugs.webkit.org/show_bug.cgi?id=154914

Reviewed by Simon Fraser.

Add a controller that centers around 30 fps instead of 60 fps.

Animometer/developer.html: Add a new option.
Animometer/resources/debug-runner/animometer.js:
Animometer/resources/runner/animometer.js:

(this._processData.findRegression): When calculating the complexity-frameLength regression,
check the controller, and use a 30 fps baseline if needed.

Animometer/resources/statistics.js:

(Regression.Utilities.createClass): Update to allow clients to specify the baseline
frame length.

Animometer/tests/resources/main.js:

(tune): Override some of the constants in RampController. Move those constants out for
easier reading.

Add a fixed controller, with no step.

Animometer/developer.html: Add a controller that takes no step.
Animometer/resources/debug-runner/animometer.js:
Animometer/tests/resources/main.js:

(Rotater.Utilities.createClass):

Switch to ramp controller as default.

Animometer/developer.html: Increase the test length to 20 seconds.
Animometer/resources/debug-runner/animometer.js: Rename the "adjustment" field to "controller"

since that is a more accurate description.

Animometer/resources/debug-runner/graph.js:
Animometer/resources/runner/animometer.js: Update preferences for release suite.

Mar 2, 2016:

11:44 PM Changeset in webkit [197497] by Chris Dumez

3 edits
2 adds in trunk

HTMLFormElement's named property getter does not return a RadioNodelist
https://bugs.webkit.org/show_bug.cgi?id=154949

Reviewed by Ryosuke Niwa.

Source/WebCore:

HTMLFormElement's named property getter should return a RadioNodeList
when there are several matches:
https://html.spec.whatwg.org/multipage/forms.html#the-form-element

Previously, WebKit returned a generic NodeList. As a result, users
cannot create a white-and-gold hat in the MAKE A HAT GREAT AGAIN
section at:
https://www.washingtonpost.com/news/the-fix/wp/2015/10/06/hey-lets-all-make-our-own-donald-trump-hats/

Chrome and Firefox already match the specification. Edge will soon.

Test: fast/dom/HTMLFormElement/named-property-getter-radionodelist.html

bindings/js/JSHTMLFormElementCustom.cpp:

(WebCore::JSHTMLFormElement::nameGetter):

LayoutTests:

Add layout test to confirm that HTMLFormElement's named property getter
does indeed return a RadioNodeList when there are several matches.

fast/dom/HTMLFormElement/named-property-getter-radionodelist-expected.txt: Added.
fast/dom/HTMLFormElement/named-property-getter-radionodelist.html: Added.

11:36 PM Changeset in webkit [197496] by commit-queue@webkit.org

5 edits in trunk/Source/WebKit2

Properly cancel downloads when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154893

Patch by Alex Christensen <achristensen@webkit.org> on 2016-03-02
Reviewed by Brady Eidson.

NetworkProcess/Downloads/Download.cpp:

(WebKit::Download::Download):

NetworkProcess/Downloads/Download.h:
NetworkProcess/Downloads/cocoa/DownloadCocoa.mm:

(WebKit::Download::cancel):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:dataTask:didBecomeDownloadTask:]):

10:37 PM Changeset in webkit [197495] by fred.wang@free.fr

2 edits in trunk/Tools

[jhbuild] Remove LLVM dependency.
https://bugs.webkit.org/show_bug.cgi?id=153274

Patch by Frederic Wang <fwang@igalia.com> on 2016-03-03
Reviewed by Carlos Garcia Campos.

gtk/jhbuild.modules:

10:31 PM Changeset in webkit [197494] by Chris Dumez

5 edits in trunk

Drop [TreatNullAs=LegacyNullString] from HTMLBaseElement.href
https://bugs.webkit.org/show_bug.cgi?id=154952

Reviewed by Ryosuke Niwa.

Source/WebCore:

Drop [TreatNullAs=LegacyNullString] from HTMLBaseElement.href as this
does not match the specification:

https://html.spec.whatwg.org/multipage/semantics.html#the-base-element

Firefox and Chrome both convert null to the string "null".

No new tests, updated the following existing test:
fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document.html

html/HTMLBaseElement.idl:

LayoutTests:

Update existing layout test now that HTMLBaseElement.href setter no
longer treats null as the empty string.

fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document-expected.txt:
fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document.html:

10:26 PM Changeset in webkit [197493] by Matt Baker

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Update MemoryTimelineView for new ruler height
https://bugs.webkit.org/show_bug.cgi?id=153904
<rdar://problem/24517259>

Reviewed by Timothy Hatcher.

UserInterface/Views/MemoryTimelineView.css:

(.timeline-view.memory > .content > .details > .timeline-ruler):
(.timeline-view.memory > .content > .details > .subtitle):
Adjust ruler top and subtitle padding for shorter timeline ruler.
Also reduced padding in the Categories heading area to tighen up
the layout a bit.

9:58 PM Changeset in webkit [197492] by fpizlo@apple.com

7 edits
1 add in trunk/Source/JavaScriptCore

RegExpExec/RegExpTest should not unconditionally speculate cell
https://bugs.webkit.org/show_bug.cgi?id=154901

Reviewed by Benjamin Poulain.

This is a three part change. It all started with a simple goal: end the rage-recompiles in
Octane/regexp by enabling the DFG and FTL to do untyped RegExpExec/RegExpTest. This keeps us
in the optimized code when you do a regexp match on a number, for example.

While implementing this, I realized that DFGOperations.cpp was bad at exception checking. When
it did check for exceptions, it used exec->hadException() instead of vm.exception(). So I
fixed that. I also made sure that the regexp operations checked for exception after doing
toString().

Unfortunately, the introduction of untyped RegExpExec/RegExpTest caused a regression on
Octane/regexp. This was because we were simultaneously scheduling replacement and OSR compiles
of some large functions with the FTL JIT. The OSR compiles were not useful. This was a
regression from the previous changes to make OSR compiles happen sooner. The problem is that
this change also removed the throttling of OSR compiles even in those cases where we suspect
that replacement is more likely. This patch reintroduces that throttling, but only in the
replacement path.

This change ends up being neutral overall.

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):

tests/stress/regexp-exec-effect-after-exception.js: Added.

9:29 PM Changeset in webkit [197491] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

[JSC] JSCell_freeListNext and JSCell_structureID are considered not overlapping
https://bugs.webkit.org/show_bug.cgi?id=154947

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-03-02
Reviewed by Filip Pizlo.

This bug was discovered while testing https://bugs.webkit.org/show_bug.cgi?id=154894.

The problem was that JSCell_freeListNext and JSCell_structureID were
considered as disjoint. When reordering instructions, the scheduler
could move the write of the StructureID first to reduce dependencies.
This would erase half of JSCell_freeListNext before we get a chance
to load the value.

This patch changes the hierarchy to make sure nothing is written
until JSCell_freeListNext is processed.

All credits for this patch go to Filip.

ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):

ftl/FTLAbstractHeapRepository.h:

9:19 PM Changeset in webkit [197490] by commit-queue@webkit.org

8 edits in trunk/Source/JavaScriptCore

[JSC] Improve Select of Doubles based on Double condition
https://bugs.webkit.org/show_bug.cgi?id=154572

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-03-02
Reviewed by Filip Pizlo.

Octane has a bunch of Select on Double based on comparing Doubles.
A few nodes generate that: ValueRep, Min, Max, etc.

On ARM64, we can improve our code a lot. ARM can do a select
based on flags with the FCSEL instruction.

On x86, this patch adds aggressive aliasing for moveDoubleConditionallyXXX.
This has obviously a much more limited impact.

assembler/MacroAssembler.h:

(JSC::MacroAssembler::moveDoubleConditionally32): Deleted.
(JSC::MacroAssembler::moveDoubleConditionally64): Deleted.
(JSC::MacroAssembler::moveDoubleConditionallyTest32): Deleted.
(JSC::MacroAssembler::moveDoubleConditionallyTest64): Deleted.
(JSC::MacroAssembler::moveDoubleConditionallyDouble): Deleted.
(JSC::MacroAssembler::moveDoubleConditionallyFloat): Deleted.

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyDouble):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyFloat):
(JSC::MacroAssemblerARM64::moveConditionally32):
(JSC::MacroAssemblerARM64::moveDoubleConditionally32):
(JSC::MacroAssemblerARM64::moveDoubleConditionally64):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyTest32):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyTest64):
(JSC::MacroAssemblerARM64::branch64):

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::moveConditionally32):
(JSC::MacroAssemblerX86Common::moveDoubleConditionally32):
(JSC::MacroAssemblerX86Common::moveDoubleConditionallyTest32):
(JSC::MacroAssemblerX86Common::moveDoubleConditionallyDouble):
(JSC::MacroAssemblerX86Common::moveDoubleConditionallyFloat):

assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::moveDoubleConditionally64):
(JSC::MacroAssemblerX86_64::moveDoubleConditionallyTest64):

b3/air/AirInstInlines.h:

(JSC::B3::Air::Inst::shouldTryAliasingDef):

b3/air/AirOpcode.opcodes:
b3/testb3.cpp:

(JSC::B3::populateWithInterestingValues):
(JSC::B3::floatingPointOperands):
(JSC::B3::int64Operands):
(JSC::B3::int32Operands):
(JSC::B3::testSelectCompareFloat):
(JSC::B3::testSelectCompareFloatToDouble):
(JSC::B3::testSelectDoubleCompareDouble):
(JSC::B3::testSelectDoubleCompareDoubleWithAliasing):
(JSC::B3::testSelectFloatCompareFloat):
(JSC::B3::testSelectFloatCompareFloatWithAliasing):
(JSC::B3::run):

9:15 PM Changeset in webkit [197489] by commit-queue@webkit.org

12 edits
12 adds in trunk/Source/JavaScriptCore

Add ability to generate a Heap Snapshot
https://bugs.webkit.org/show_bug.cgi?id=154847

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-02
Reviewed by Mark Lam.

This adds HeapSnapshot, HeapSnapshotBuilder, and HeapProfiler.

HeapProfiler hangs off of the VM and holds the list of snapshots.
I expect to add other HeapProfiling features, such as allocation
tracking, to the profiler.

HeapSnapshot contains a collection of live cells and their identifiers.
It can point to a previous HeapSnapshot, to ensure that a cell that
already received an identifier maintains the same identifier across
multiple snapshots. When a snapshotted cell gets garbage collected,
the cell will be swept from the HeapSnapshot at the end of collection
to ensure the list contains only live cells.

When building a HeapSnapshot nodes are added in increasing node
identifier order. When done building, the list of nodes is complete
and the snapshot is finalized. At this point the nodes are sorted
by JSCell* address to allow for quick lookup of a JSCell*.

HeapSnapshotBuilder is where snapshotting begins. The builder
will initiate a specialized heap snapshotting garbage collection.
During this collection the builder will be notified of all marked
(live) cells, and connections between cells, as seen by SlotVisitors.
The builder can reference the previous, readonly, HeapSnapshots to
avoid creating new nodes for cells that have already been snapshotted.
When it is determined that we are visiting a live cell for the first
time, we give the cell a unique identifier and add it to the the
snapshot we are building.

Since edge data is costly, and of little long term utility, this
data is only held by the builder for serialization, and not stored
long term with the HeapSnapshot node data.

The goals of HeapSnapshotting at this time are:

minimal impact on performance when not profiling the heap
unique identifier for cells, so they may be identified across multiple snapshots
nodes and edges to be able to construct a graph of which nodes reference/retain which other nodes
node data - identifier, type (class name), size
edge data - from cell, to cell, type / data (to come in a follow-up patch)

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:

Add new files to the build.

heap/Heap.cpp:

(JSC::Heap::isHeapSnapshotting):
(JSC::RemoveDeadHeapSnapshotNodes::RemoveDeadHeapSnapshotNodes):
(JSC::RemoveDeadHeapSnapshotNodes::operator()):
(JSC::Heap::removeDeadHeapSnapshotNodes):
(JSC::Heap::collectImpl):
After every collection, sweep dead cells from in memory snapshots.

runtime/VM.cpp:

(JSC::VM::ensureHeapProfiler):

runtime/VM.h:

(JSC::VM::heapProfiler):

heap/Heap.h:
heap/HeapProfiler.cpp: Added.

(JSC::HeapProfiler::HeapProfiler):
(JSC::HeapProfiler::~HeapProfiler):
(JSC::HeapProfiler::mostRecentSnapshot):
(JSC::HeapProfiler::appendSnapshot):
(JSC::HeapProfiler::clearSnapshots):
(JSC::HeapProfiler::setActiveSnapshotBuilder):

heap/HeapProfiler.h: Added.

(JSC::HeapProfiler::vm):
(JSC::HeapProfiler::activeSnapshotBuilder):
VM and Heap can look at the profiler to determine if we are building a
snapshot, or the "head" snapshot to use for sweeping.

heap/HeapSnapshot.cpp: Added.

(JSC::HeapSnapshot::HeapSnapshot):
(JSC::HeapSnapshot::~HeapSnapshot):
(JSC::HeapSnapshot::appendNode):
Add a node to the unfinalized list of new cells.

(JSC::HeapSnapshot::sweepCell):
(JSC::HeapSnapshot::shrinkToFit):
Collect a list of cells for sweeping and then remove them all at once
in shrinkToFit. This is done to avoid thrashing of individual removes
that could cause many overlapping moves within the Vector.

(JSC::HeapSnapshot::finalize):
Sort the list, and also cache the bounding start/stop identifiers.
No other snapshot can contain an identifier in this range, so it will
improve lookup of a node from an identifier.

(JSC::HeapSnapshot::nodeForCell):
(JSC::HeapSnapshot::nodeForObjectIdentifier):
Search helpers.

heap/HeapSnapshotBuilder.h: Added.

(JSC::HeapSnapshotNode::HeapSnapshotNode):
(JSC::HeapSnapshotEdge::HeapSnapshotEdge):
Node and Edge struct types the builder creates.

heap/HeapSnapshotBuilder.cpp: Added.

(JSC::HeapSnapshotBuilder::getNextObjectIdentifier):
(JSC::HeapSnapshotBuilder::HeapSnapshotBuilder):
(JSC::HeapSnapshotBuilder::~HeapSnapshotBuilder):
(JSC::HeapSnapshotBuilder::buildSnapshot):
(JSC::HeapSnapshotBuilder::appendNode):
(JSC::HeapSnapshotBuilder::appendEdge):
When building the snapshot, generating the next identifier, and
appending to any of the lists must be guarded by a lock because
SlotVisitors running in parallel may be accessing the builder.

(JSC::HeapSnapshotBuilder::hasExistingNodeForCell):
Looking up if a node already exists in a previous snapshot can be
done without a lock because at this point the data is readonly.

(JSC::edgeTypeToNumber):
(JSC::edgeTypeToString):
(JSC::HeapSnapshotBuilder::json):
JSON serialization of a heap snapshot contains node and edge data.

heap/SlotVisitor.h:
heap/SlotVisitor.cpp:

(JSC::SlotVisitor::didStartMarking):
(JSC::SlotVisitor::reset):
Set/clear the active snapshot builder to know if this will be a
snapshotting GC or not.

(JSC::SlotVisitor::append):
(JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
Inform the builder of a new node or edge.

(JSC::SlotVisitor::visitChildren):
Remember the current cell we are visiting so that if we need to
inform the builder of edges we know the "from" cell.

jsc.cpp:

(SimpleObject::SimpleObject):
(SimpleObject::create):
(SimpleObject::finishCreation):
(SimpleObject::visitChildren):
(SimpleObject::createStructure):
(SimpleObject::hiddenValue):
(SimpleObject::setHiddenValue):
Create a new class "SimpleObject" that can be used by heap snapshotting
tests. It is easy to filter for this new class name and test internal
edge relationships created by garbage collection visiting the cell.

(functionCreateSimpleObject):
(functionGetHiddenValue):
(functionSetHiddenValue):
Expose methods to create and interact with a SimpleObject.

(functionGenerateHeapSnapshot):
Expose methods to create a heap snapshot. This currently automatically
turns the serialized string into a JSON object. That may change.

tests/heapProfiler.yaml: Added.
tests/heapProfiler/basic-edges.js: Added.

(excludeStructure):

tests/heapProfiler/basic-nodes.js: Added.

(hasDifferentSizeNodes):
(hasAllInternalNodes):
Add tests for basic node and edge data.

tests/heapProfiler/driver/driver.js: Added.

(assert):
(CheapHeapSnapshotNode):
(CheapHeapSnapshotEdge):
(CheapHeapSnapshotEdge.prototype.get from):
(CheapHeapSnapshotEdge.prototype.get to):
(CheapHeapSnapshot):
(CheapHeapSnapshot.prototype.get nodes):
(CheapHeapSnapshot.prototype.get edges):
(CheapHeapSnapshot.prototype.nodeWithIdentifier):
(CheapHeapSnapshot.prototype.nodesWithClassName):
(CheapHeapSnapshot.prototype.classNameFromTableIndex):
(CheapHeapSnapshot.prototype.edgeTypeFromTableIndex):
(createCheapHeapSnapshot):
(HeapSnapshotNode):
(HeapSnapshotEdge):
(HeapSnapshot):
(HeapSnapshot.prototype.nodesWithClassName):
(createHeapSnapshot):
Add two HeapSnapshot representations.
CheapHeapSnapshot creates two lists of node and edge data that
lazily creates objects as needed.
HeapSnapshot creates an object for each node and edge. This
is wasteful but easier to use.

7:50 PM Changeset in webkit [197488] by Matt Baker

9 edits
2 copies in trunk/Source/WebInspectorUI

Web Inspector: Timelines UI redesign: replace content view container with a content browser
https://bugs.webkit.org/show_bug.cgi?id=153033
<rdar://problem/24195565>

Reviewed by Timothy Hatcher.

This patch replaces the ContentViewContainer in the Timelines tab with a ContentBrowser,
moves filtering controls from the sidebar to the new browser's navigation bar, and adds
a new leaf path component for the current ruler selection to the main content browser's
navigation bar.

Localizations/en.lproj/localizedStrings.js:

New UI strings.

UserInterface/Base/Utilities.js:

Added global en dash string.

UserInterface/Main.html:
UserInterface/Test.html:

New files.

UserInterface/Models/TimelineRange.js:

(WebInspector.TimelineRange):
(WebInspector.TimelineRange.prototype.get startValue):
(WebInspector.TimelineRange.prototype.set startValue):
(WebInspector.TimelineRange.prototype.get endValue):
(WebInspector.TimelineRange.prototype.set endValue):
New represented object used by ruler selection path components.

UserInterface/Views/FilterBarNavigationItem.js:

(WebInspector.FilterBarNavigationItem):
(WebInspector.FilterBarNavigationItem.prototype.get filterBar):
Adapter class for using a FilterBar as a NavigationItem.

UserInterface/Views/TimelineIcons.css:

(.time-icon .icon):
Icon class used by ruler selection path component.

UserInterface/Views/TimelineRecordingContentView.css:

(.content-view.timeline-recording > .content-browser):
(.content-view.timeline-recording > .content-browser > .navigation-bar):
(.content-view.timeline-recording > .content-browser > .navigation-bar > .item.scope-bar.default-item-selected > .multiple):
(.content-view.timeline-recording > .content-browser > .navigation-bar > .item.scope-bar.default-item-selected > .multiple .arrows):
(.content-view.timeline-recording > .content-browser > .content-view-container > .timeline-view > .data-grid td):
(.content-view.timeline-recording > .content-browser > .content-view-container > .timeline-view > .data-grid table.data):
(.content-view.timeline-recording > .content-view-container): Deleted.
(.content-view.timeline-recording > .content-view-container > .timeline-view > .data-grid td): Deleted.
(.content-view.timeline-recording > .content-view-container > .timeline-view > .data-grid table.data): Deleted.
New styles for the ContentBrowser that replaces the ContentViewContainer.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView):
Create the ContentBrowser, ruler selection path components, and the browser's filter bar.

(WebInspector.TimelineRecordingContentView.prototype.showOverviewTimelineView):
(WebInspector.TimelineRecordingContentView.prototype.showTimelineViewForTimeline):
Implemented by the content browser instead of the view container.

(WebInspector.TimelineRecordingContentView.prototype.get selectionPathComponents):
Add timeline and selection path components. Components for the current TimelineView
are now located in the lower content browser's navigation bar.

(WebInspector.TimelineRecordingContentView.prototype.get supplementalRepresentedObjects):
(WebInspector.TimelineRecordingContentView.prototype.get handleCopyEvent):
(WebInspector.TimelineRecordingContentView.prototype.get supportsSave):
(WebInspector.TimelineRecordingContentView.prototype.get saveData):
(WebInspector.TimelineRecordingContentView.prototype.get currentTimelineView):
(WebInspector.TimelineRecordingContentView.prototype.shown):
(WebInspector.TimelineRecordingContentView.prototype.hidden):
(WebInspector.TimelineRecordingContentView.prototype.closed):
(WebInspector.TimelineRecordingContentView.prototype.canGoBack):
(WebInspector.TimelineRecordingContentView.prototype.canGoForward):
(WebInspector.TimelineRecordingContentView.prototype.goBack):
(WebInspector.TimelineRecordingContentView.prototype.goForward):
(WebInspector.TimelineRecordingContentView.prototype.saveToCookie):
Implemented by the content browser instead of the view container.

(WebInspector.TimelineRecordingContentView.prototype.contentBrowserTreeElementForRepresentedObject):
Create the root tree element for the lower content browser's navigation bar.

(WebInspector.TimelineRecordingContentView.prototype._timeRangePathComponentSelected):
Update the ruler selection based on the new path component.

(WebInspector.TimelineRecordingContentView.prototype._contentViewSelectionPathComponentDidChange):
(WebInspector.TimelineRecordingContentView.prototype._contentViewSupplementalRepresentedObjectsDidChange):
(WebInspector.TimelineRecordingContentView.prototype._updateTimes):
(WebInspector.TimelineRecordingContentView.prototype._updateTimelineOverviewHeight):
Implemented by the content browser instead of the view container.

(WebInspector.TimelineRecordingContentView.prototype._timeRangeSelectionChanged):
Update the currently selected path component when the ruler selection changes.
If the entire range is selected, show the "Entire Recording" path component,
otherwise update the TimelineRange of the path component for the user-defined
selection and refresh all timeline range path components.

(WebInspector.TimelineRecordingContentView.prototype._updateTimeRangePathComponents):
Update title text and sibling relationships for ruler selection path components.

(WebInspector.TimelineRecordingContentView.prototype._createTimelineRangePathComponent):
Helper function for creating TimelineRange path components.

(WebInspector.TimelineRecordingContentView.prototype._currentContentViewDidChange):
The TimelineView scope bar is no longer added to the sidebar. The UI has been moved
to the lower content browser navigation bar.

(WebInspector.TimelineRecordingContentView.prototype._updateFrameSelection): Deleted.
No longer needed since the selected range is shown in the navigation bar.

UserInterface/Views/TimelineView.js:

(WebInspector.TimelineView.prototype.get navigationItems):
Adds the TimelineView's scope bar (if any) to the lower content browser's navigation
bar. Items are inserted before the filter bar, which is always the right-most item.

7:45 PM Changeset in webkit [197487] by Matt Baker

21 edits in trunk/Source/WebInspectorUI

Web Inspector: Timelines UI redesign: show content tree outline records in timeline data grids
https://bugs.webkit.org/show_bug.cgi?id=153032
<rdar://problem/24195317>

Reviewed by Timothy Hatcher.

This patch relocates the data shown in the Timelines navigation sidebar content tree outline
to a new grid column in each TimelineDataGrid. Logic for creating subtitles, goto arrow buttons,
and status elements (the progress spinner used for network resources) has been replicated in
the appropriate TimelineDataGridNode classes.

Duplicate logic contained in TimelineRecordTreeElement classes is left in place for now, but
will be removed in <https://webkit.org/b/153036>.

UserInterface/Views/DataGrid.css:

(.data-grid td.error):
Use --error-text-color CSS variable.

UserInterface/Views/DataGrid.js:

Removed GoToArrowClicked event.
(WebInspector.DataGridNode.prototype.createGoToArrowButton.buttonClicked): Deleted.
(WebInspector.DataGridNode.prototype.createGoToArrowButton): Deleted.
Now part of TimelineDataGridNode.

UserInterface/Views/LayoutTimelineDataGridNode.js:

(WebInspector.LayoutTimelineDataGridNode):
(WebInspector.LayoutTimelineDataGridNode.prototype.get data):
Add name cell to row data.
(WebInspector.LayoutTimelineDataGridNode.prototype.createCellContent):
Create name cell.

UserInterface/Views/LayoutTimelineView.css:

(.timeline-view.layout > .data-grid .eventType-column): Deleted.
Column border no longer hidden.

UserInterface/Views/LayoutTimelineView.js:

(WebInspector.LayoutTimelineView):
Setup name column.

UserInterface/Views/NetworkTimelineView.css:

(.timeline-view.network > .data-grid .name-column .subtitle):
Don't show subtitles in the Network grid's name column.

UserInterface/Views/NetworkTimelineView.js:

(WebInspector.NetworkTimelineView):
Setup name column.

UserInterface/Views/OverviewTimelineView.css:

(.timeline-view.overview > .data-grid th.graph-column > .timeline-ruler):
(.timeline-view.overview > .data-grid th.graph-column > .timeline-ruler > .header):
(.timeline-view.overview > .data-grid th):
(body.window-inactive .timeline-view.overview > .data-grid th):
(.timeline-view.overview .timeline-ruler > .event-markers):
(.timeline-view.overview > .data-grid):
(.timeline-view.overview > .timeline-ruler): Deleted.
(.timeline-view.overview > .timeline-ruler > .header): Deleted.
(body.window-inactive .timeline-view.overview > .timeline-ruler > .header): Deleted.
(.timeline-view.overview > .timeline-ruler > .event-markers): Deleted.
New styles for adding grid column headers and using a TimelineRuler as the
graph column header.

UserInterface/Views/OverviewTimelineView.js:

(WebInspector.OverviewTimelineView):
Setup name column and add ruler to graph column header.

UserInterface/Views/ProfileNodeDataGridNode.js:

(WebInspector.ProfileNodeDataGridNode):
Use cached data instead of creating row data at construction time.
(WebInspector.ProfileNodeDataGridNode.prototype.get data):
Add name cell to row data.
(WebInspector.ProfileNodeDataGridNode.prototype.createCellContent):
Create name cell.
(WebInspector.ProfileNodeDataGridNode.prototype._iconClassNameForProfileNode):
(WebInspector.ProfileNodeDataGridNode.prototype._titleForProfileNode):
Copied from ProfileNodeTreeElement.

UserInterface/Views/RenderingFrameTimelineDataGridNode.js:

(WebInspector.RenderingFrameTimelineDataGridNode):
(WebInspector.RenderingFrameTimelineDataGridNode.prototype.get data):
Add name cell to row data.
(WebInspector.RenderingFrameTimelineDataGridNode.prototype.createCellContent):
Create name cell.

UserInterface/Views/RenderingFrameTimelineView.js:

(WebInspector.RenderingFrameTimelineView):
Setup name column.

UserInterface/Views/ResourceTimelineDataGridNode.js:

(WebInspector.ResourceTimelineDataGridNode):
Renamed "graphOnly" to "includesGraph", since resource rows in the overview
now show the name column in addition to the graph column. Resource events
LoadingDidFinish and LoadingDidFail now need to be handled for both types
of resource rows.

(WebInspector.ResourceTimelineDataGridNode.prototype.get data):
(WebInspector.ResourceTimelineDataGridNode.prototype.createCellContent):
Update resource status element and create name cell content.
(WebInspector.ResourceTimelineDataGridNode.prototype._createNameCellDocumentFragment):
Create DOM fragment with titles. Based on code in TimelineRecordTreeElement.
(WebInspector.ResourceTimelineDataGridNode.prototype._dataGridNodeGoToArrowClicked):
Show resource when goto arrow is clicked.
(WebInspector.ResourceTimelineDataGridNode.prototype._updateStatus):
Update name cell's text color and progress spinner.

UserInterface/Views/ResourceTreeElement.css:

(.item.resource.failed):
(.item.resource.failed .subtitle):
Use --error-text-color CSS variable.

UserInterface/Views/ScriptTimelineDataGridNode.js:

(WebInspector.ScriptTimelineDataGridNode):
(WebInspector.ScriptTimelineDataGridNode.prototype.createCellContent):
(WebInspector.ScriptTimelineDataGridNode.prototype._createNameCellDocumentFragment):
Create DOM fragment with titles. Based on code in TimelineRecordTreeElement.

UserInterface/Views/ScriptTimelineView.js:

(WebInspector.ScriptTimelineView):
Setup name column.

UserInterface/Views/SourceCodeTimelineTimelineDataGridNode.js:

(WebInspector.SourceCodeTimelineTimelineDataGridNode.prototype.createCellContent):
Added now that this node type is no longer "graph only".
(WebInspector.SourceCodeTimelineTimelineDataGridNode.prototype._createNameCellContent):
Create DOM fragment with titles. Based on code in TimelineRecordTreeElement.

UserInterface/Views/TimelineDataGridNode.js:

(WebInspector.TimelineDataGridNode):
Renamed graphOnly to includesGraph.
(WebInspector.TimelineDataGridNode.prototype.createCellContent):
Removed icon element creation. This is now handled by the DataGrid.
(WebInspector.TimelineDataGridNode.prototype.refresh):
Refresh of all node cells after updating the graph.
(WebInspector.TimelineDataGridNode.prototype.createGoToArrowButton):
(WebInspector.TimelineDataGridNode.prototype.createGoToArrowButton.buttonClicked):
Relocated from DataGrid, as it's only used by TimelineDataGridNodes.

UserInterface/Views/TimelineView.css:

(.timeline-view > .data-grid .indeterminate-progress-spinner):
Styles for grid cell progress spinners.

UserInterface/Views/Variables.css:

(:root):
Added --error-text-color variable to remove duplication.

7:30 PM Changeset in webkit [197486] by Alan Bujtas

4 edits
2 adds in trunk

Paint table borders on empty cells even in quirks mode.
https://bugs.webkit.org/show_bug.cgi?id=154928

Reviewed by David Hyatt.

Enable border painting for empty cells unless 'empty-cells: hide' is set.
This is inline with FF and Chrome behaviour.

Source/WebCore:

Test: fast/table/border-on-empty-table-cells-quirks-mode.html

rendering/RenderTableCell.cpp:

(WebCore::RenderTableCell::paintBoxDecorations):

LayoutTests:

fast/table/border-on-empty-table-cells-quirks-mode-expected.html: Added.
fast/table/border-on-empty-table-cells-quirks-mode.html: Added.

6:06 PM Changeset in webkit [197485] by fpizlo@apple.com

5 edits in trunk/Source/JavaScriptCore

RegExpPrototype should check for exceptions after calling toString and doing so should not be expensive
https://bugs.webkit.org/show_bug.cgi?id=154927

Reviewed by Saam Barati.

While working on regexp optimizations, I found that RegExpPrototype calls toString(), an
effectful operation that could do anything, without then checking for hadException().

So I added a call to hadException().

But that regressed Octane/regexp by 5%! That's a lot! It turns out that
exec->hadException() is soooper slow. So, I made it cheaper to check for exceptions from
toString(): there is now a variant called toStringFast() that returns null iff it throws an
exception.

This allowed me to add the exception check without regressing perf.

Note that toString() must retain its old behavior of returning an empty string on exception.
There is just too much code that relies on that behavior.

runtime/JSCJSValue.cpp:

(JSC::JSValue::isValidCallee):
(JSC::JSValue::toStringSlowCase):
(JSC::JSValue::toWTFStringSlowCase):

runtime/JSCJSValue.h:

(JSC::JSValue::asValue):

runtime/JSString.h:

(JSC::JSValue::toString):
(JSC::JSValue::toStringFast):
(JSC::JSValue::toWTFString):

runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncTest):
(JSC::regExpProtoFuncExec):
(JSC::regExpProtoFuncCompile):

6:04 PM Changeset in webkit [197484] by sbarati@apple.com

15 edits in trunk/Source/JavaScriptCore

clean up JSObject::isExtensibleInline and JSObject::setPrototypeOfInline, and rename setPrototypeOf to setPrototype
https://bugs.webkit.org/show_bug.cgi?id=154942

Reviewed by Benjamin Poulain.

These don't need to be inlined in the way they are.
Doing dynamic dispatch is ok performance wise until
we have evidence stating otherwise.

API/JSObjectRef.cpp:

(JSObjectSetPrototype):
(JSObjectHasProperty):

runtime/ClassInfo.h:
runtime/IntlCollatorConstructor.cpp:

(JSC::constructIntlCollator):

runtime/IntlDateTimeFormatConstructor.cpp:

(JSC::constructIntlDateTimeFormat):

runtime/IntlNumberFormatConstructor.cpp:

(JSC::constructIntlNumberFormat):

runtime/JSCell.cpp:

(JSC::JSCell::isExtensible):
(JSC::JSCell::setPrototype):
(JSC::JSCell::setPrototypeOf): Deleted.

runtime/JSCell.h:
runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoSetter):

runtime/JSObject.cpp:

(JSC::JSObject::setPrototypeWithCycleCheck):
(JSC::JSObject::setPrototype):
(JSC::JSObject::allowsAccessFrom):
(JSC::JSObject::isExtensible):
(JSC::JSObject::reifyAllStaticProperties):
(JSC::JSObject::defineOwnNonIndexProperty):
(JSC::JSObject::setPrototypeOf): Deleted.

runtime/JSObject.h:

(JSC::JSObject::mayInterceptIndexedAccesses):
(JSC::JSObject::indexingShouldBeSparse):
(JSC::JSObject::setPrototypeOfInline): Deleted.
(JSC::JSObject::isExtensibleInline): Deleted.

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorSetPrototypeOf):
(JSC::objectConstructorIsSealed):
(JSC::objectConstructorIsFrozen):
(JSC::objectConstructorIsExtensible):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::performPreventExtensions):
(JSC::ProxyObject::performIsExtensible):

runtime/ReflectObject.cpp:

(JSC::reflectObjectIsExtensible):
(JSC::reflectObjectSetPrototypeOf):

runtime/StringObject.cpp:

(JSC::StringObject::defineOwnProperty):

5:29 PM Changeset in webkit [197483] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking storage/indexeddb/odd-strings.html as flaky on mac-wk1
https://bugs.webkit.org/show_bug.cgi?id=154619

Unreviewed test gardening.

platform/mac-wk1/TestExpectations:

5:22 PM Changeset in webkit [197482] by beidson@apple.com

2 edits in trunk/LayoutTests

Unreviewed test gardening.

platform/wk2/TestExpectations: Mark two tests that are very slow as [ Slow ].

5:20 PM Changeset in webkit [197481] by rniwa@webkit.org

6 edits
8 deletes in trunk

HTML parser instantiates a custom element inside a template element with a wrong owner document
https://bugs.webkit.org/show_bug.cgi?id=154936

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

Updated the expected results for newly passing test cases.

One test case in additions-to-parsing-xhtml-documents/node-document.html starts failing due to a bug in the test.
The bug in the test will be fixed in https://github.com/w3c/web-platform-tests/pull/2651

Finally, remove duplicated HTML template element tests in html-templates since there is a new copy under
web-platform-tests/html/semantics/scripting-1/the-template-element/. Unfortunately, we can't remove
html-templates/parsing-html-templates/ because we haven't imported web-platform-tests/html/syntax yet.

html-templates/additions-to-parsing-xhtml-documents: Removed.
html-templates/additions-to-serializing-xhtml-documents: Removed.
html-templates/additions-to-the-css-user-agent-style-sheet: Removed.
html-templates/additions-to-the-steps-to-clone-a-node: Removed.
html-templates/definitions: Removed.
html-templates/innerhtml-on-templates: Removed.
html-templates/serializing-html-templates: Removed.
html-templates/template-element: Removed.
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/node-document.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents-owner-test-001-expected.txt:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/node-document-changes-expected.txt:

Source/WebCore:

The bug was caused by our implementation following the old spec which didn't create a appropriate template
contents owner document [1] for a document without a browsing context. The new spec no longer has this clause,
and we should be always creating the appropriate template contents owner document unless the document itself
is an appropriate template contents owner document for another document (comes up in nested template elements).

No new tests since the behavior change is covered by existing tests.

[1] https://html.spec.whatwg.org/#appropriate-template-contents-owner-document

dom/Document.h:

(WebCore::Document::templateDocument):

5:19 PM Changeset in webkit [197480] by barraclough@apple.com

3 edits in trunk/Source/WebCore

PageThrottler should apply hysteresis to media activity
https://bugs.webkit.org/show_bug.cgi?id=154940

Reviewed by Ryosuke Niwa.

Currently PageThrottler keeps a track of audible plugin activity and HTML media element
activity separately. Audible plugin activity also gets an extra 5s hysteresis applied,
so that after audio playback has completed there is a chance to queue up more audio
before timer throttling kicks in. HTML audio does not get this grace. Funnel both
together into a single activity flag, such that the hysteresis is applied to both.

page/PageThrottler.cpp:

(WebCore::PageThrottler::PageThrottler):
(WebCore::m_mediaActivityHysteresis):

PageActivityState::AudiblePlugin -> PageActivityState::MediaActivity.

(WebCore::m_mediaActivityCounter):

when m_mediaActivityCounter value changes call mediaActivityCounterChanged().

(WebCore::PageThrottler::mediaActivityCounterChanged):

Drive PageActivityState::MediaActivity indirectly via m_mediaActivityHysteresis, such that a 5s hysteresis is applied.

page/PageThrottler.h:
- Removed AudiblePlugin (merged in with MediaActivity).

(WebCore::PageThrottler::pluginDidEvaluateWhileAudioIsPlaying):

m_audiblePluginHysteresis.impulse -> m_mediaActivityHysteresis.impulse.

4:34 PM Changeset in webkit [197479] by Matt Baker

6 edits
1 add in trunk/Source/WebInspectorUI

Web Inspector: Timelines UI redesign: relocate recording controls to TimelineTabContentView's content browser
https://bugs.webkit.org/show_bug.cgi?id=153532
<rdar://problem/24361611>

Reviewed by Timothy Hatcher.

This patch shifts UI controller responsibilities from the sidebar panel
to the tab content view. Controls for starting/stopping the recording and
switching view modes are now located in the tab's navigation bar, as is
the hidden tree outline of open timeline recordings.

Localizations/en.lproj/localizedStrings.js:

New UI strings. Renamed view-mode radio buttons located from the sidebar
to "Events" and "Frames". UI for switching modes isn't final, and the
labels may change or be removed entirely in favor of image-only buttons.

UserInterface/Main.html:

New file.

UserInterface/Views/ContentBrowserTabContentView.js:

(WebInspector.ContentBrowserTabContentView.prototype.contentBrowserTreeElementForRepresentedObject):
(WebInspector.ContentBrowserTabContentView.prototype.treeElementForRepresentedObject):
Allow subclasses to override behavior for retrieving the tree element
for a represented object. Default behavior delegates the implementation
to the navigation sidebar.

(WebInspector.ContentBrowserTabContentView.prototype._contentBrowserCurrentContentViewDidChange):
(WebInspector.ContentBrowserTabContentView.prototype._revealAndSelectRepresentedObject):
(WebInspector.ContentBrowserTabContentView):
(WebInspector.ContentBrowserTabContentView.prototype._revealAndSelectRepresentedObjectInNavigationSidebar): Deleted.
Renamed to _revealAndSelectRepresentedObject as it's no longer specific
to the sidebar.

UserInterface/Views/TabContentView.js:

(WebInspector.TabContentView):
(WebInspector.TabContentView.prototype.restoreStateFromCookie):
(WebInspector.TabContentView.prototype.saveStateToCookie):
A navigation sidebar shouldn't be required to save/restore cookie state.

UserInterface/Views/TimelineTabContentView.css: Added.

(.timeline.tab.content-view .navigation-bar > .item.toggle-navigation-sidebar.activate.button):
(.timeline.tab.content-view .navigation-bar > .item.record-start-stop):
(.timeline.tab.content-view .navigation-bar > .item.record-start-stop:hover):
(.timeline.tab.content-view .navigation-bar > .item.record-start-stop:active):
(.timeline.tab.content-view .navigation-bar > .item.record-start-stop *):
(.timeline.tab.content-view .navigation-bar > .item.radio):
Styles for new navigation items: record button and view mode radio buttons.

UserInterface/Views/TimelineTabContentView.js:

Logic for maintaining the timeline recording hierarchy and the state
of the active recording has been added to the tab content view.

(WebInspector.TimelineTabContentView):
(WebInspector.TimelineTabContentView.prototype.shown):
(WebInspector.TimelineTabContentView.prototype.hidden):
(WebInspector.TimelineTabContentView.prototype.canShowRepresentedObject):
Objects other than recordings are no longer shown in the tab's content
browser. Displaying other objects (such as timeline resources) in the
content browser will be addressed in a follow-up patch: https://bugs.webkit.org/show_bug.cgi?id=154920.

(WebInspector.TimelineTabContentView.prototype.get supportsSplitContentBrowser):
(WebInspector.TimelineTabContentView.prototype.restoreFromCookie):
(WebInspector.TimelineTabContentView.prototype.saveToCookie):
Persist view state that was previously located in the sidebar.

(WebInspector.TimelineTabContentView.prototype.treeElementForRepresentedObject):
Implements logic previously limited to the navigation sidebar. Only tree
elements for timeline recordings are supported, since other represented
objects (timeline resources) no longer have content tree outline tree elements.

(WebInspector.TimelineTabContentView.prototype._capturingStartedOrStopped):
(WebInspector.TimelineTabContentView.prototype._toggleRecordingOnSpacebar):
(WebInspector.TimelineTabContentView.prototype._toggleNewRecordingOnSpacebar):
(WebInspector.TimelineTabContentView.prototype._toggleRecording):
(WebInspector.TimelineTabContentView.prototype._recordButtonClicked):
(WebInspector.TimelineTabContentView.prototype._recordingsTreeSelectionDidChange):
(WebInspector.TimelineTabContentView.prototype._recordingCreated):
(WebInspector.TimelineTabContentView.prototype._addRecording):
(WebInspector.TimelineTabContentView.prototype._recordingCountChanged):
(WebInspector.TimelineTabContentView.prototype._recordingLoaded):
Implementations copied from the sidebar panel.

(WebInspector.TimelineTabContentView.prototype._recordingSelected):
Implementation similar to that which existed in the sidebar panel, except
that logic related to instruments isn't needed. Updates to timeline view
filters will be implemented in a follow-up patch: https://bugs.webkit.org/show_bug.cgi?id=154924.

(WebInspector.TimelineTabContentView.prototype._viewModeSelected):
This method is now limited to the handling of the radio button event only.
Additional logic which existed in the sidebar panel's implementation has
been pushed into _changeViewMode, which does the actual work of toggling
view modes.

(WebInspector.TimelineTabContentView.prototype._changeViewMode):
Updates the current view mode state. If triggered by a user selection (was
called by the radio button event handler), the correct timeline view for
the new mode is shown.

(WebInspector.TimelineTabContentView.prototype._showTimelineViewForType):
Helper function for showing the view for the specified timeline type, if
the timeline exists in the current recording. Otherwise the overview timeline
view is displayed.

(WebInspector.TimelineTabContentView.prototype._displayedContentViewNavigationItemsDidChange):
Keep the view mode in sync with the content browser.

(WebInspector.TimelineTabContentView.prototype._getTimelineForCurrentContentView):
Helper function for getting the currently displayed timeline.

4:34 PM Changeset in webkit [197478] by adachan@apple.com

19 edits in trunk/Source

Update the media element's presentation mode properly after going in and out of full screen via the Full Screen API
https://bugs.webkit.org/show_bug.cgi?id=154834

Reviewed by Simon Fraser.

Source/WebCore:

dom/Document.cpp:

(WebCore::Document::webkitWillEnterFullScreenForElement):

dom/Element.cpp:

(WebCore::Element::willBecomeFullscreenElement):

dom/Element.h:

(WebCore::Element::ancestorWillEnterFullscreen):

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::enterFullscreen):
If the Full Screen API is enabled and this media element is entering a mode other than standard
full screen, see if it's currently contained in a full screen element. If so, exit full screen.
(WebCore::HTMLMediaElement::willBecomeFullscreenElement):
If this media element is going to standard full screen, update its presentation mode. If
this media element also supports presentation mode and it currently has a presentation mode
that's not standard full screen, exit that presentation mode directly without animation.
(WebCore::HTMLMediaElement::willStopBeingFullscreenElement):
Set the presentation mode back to inline unless it's already changed to a different
presentation mode.

html/HTMLMediaElement.h:
html/HTMLVideoElement.cpp:

(WebCore::HTMLVideoElement::ancestorWillEnterFullscreen):
Reset this video element's presentation state to inline if its ancestor is going to full screen.
(WebCore::HTMLVideoElement::exitToFullscreenModeWithoutAnimationIfPossible):
If the fullscreen mode the video element is exiting from is supported, exit that mode to the new mode.

html/HTMLVideoElement.h:
page/ChromeClient.h:
platform/mac/WebVideoFullscreenInterfaceMac.h:
platform/mac/WebVideoFullscreenInterfaceMac.mm:

(WebCore::WebVideoFullscreenInterfaceMac::exitFullscreenWithoutAnimationToMode):

Source/WebKit2:

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.h:
UIProcess/Cocoa/WebVideoFullscreenManagerProxy.messages.in:
UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::exitFullscreenWithoutAnimationToMode):
Call the new exitFullscreenWithoutAnimationToMode() method on WebVideoFullscreenInterfaceMac.

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::exitVideoFullscreenToModeWithoutAnimation):

WebProcess/WebCoreSupport/WebChromeClient.h:
WebProcess/cocoa/WebVideoFullscreenManager.h:
WebProcess/cocoa/WebVideoFullscreenManager.mm:

(WebKit::WebVideoFullscreenManager::exitVideoFullscreenToModeWithoutAnimation):

4:29 PM Changeset in webkit [197477] by bshafiei@apple.com

5 edits in tags/Safari-601.5.17.4/Source

Versioning.

4:26 PM Changeset in webkit [197476] by Ryan Haddad

2 edits in trunk/LayoutTests

Skip unsupported test fast/text/complex-small-caps-non-bmp-capitalize.html on ios-simulator

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

4:24 PM Changeset in webkit [197475] by bshafiei@apple.com

1 copy in tags/Safari-601.5.17.4

New tag.

4:23 PM Changeset in webkit [197474] by beidson@apple.com

14 edits
6 adds in trunk

Modern IDB: Close UniqueIDBDatabases once they become unused.
https://bugs.webkit.org/show_bug.cgi?id=154922

Reviewed by Alex Christensen.

Source/WebCore:

Tests: storage/indexeddb/modern/256-open-databases.html

storage/indexeddb/modern/exceed-open-file-limit.html

Without this change, attempts to open a 256th database in the DatabaseProcess will fail on Mac.

Due to SQLite journal files, this limit could come up as early as 128 databases if they are all
in active use.

This is because launchd - by default - limits xpc services to having 256 open file handles by default.

While we should explore raising the limit, we should also close databases we no longer need.

Modules/indexeddb/server/IDBBackingStore.h:

Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::closeUniqueIDBDatabase):
(WebCore::IDBServer::IDBServer::deleteUniqueIDBDatabase): Deleted.

Modules/indexeddb/server/IDBServer.h:

Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:

(WebCore::IDBServer::MemoryBackingStoreTransaction::MemoryBackingStoreTransaction):

Modules/indexeddb/server/MemoryIDBBackingStore.cpp:

(WebCore::IDBServer::MemoryIDBBackingStore::getOrEstablishDatabaseInfo):

Modules/indexeddb/server/MemoryIDBBackingStore.h:

Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo):

Modules/indexeddb/server/SQLiteIDBBackingStore.h:

Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::UniqueIDBDatabase):
(WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
(WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation): Handle the case where opening

the backing store failed by firing an error event instead of pretending everything is okay.

(WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore):
(WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):
(WebCore::IDBServer::UniqueIDBDatabase::openBackingStore):
(WebCore::IDBServer::UniqueIDBDatabase::didOpenBackingStore):
(WebCore::IDBServer::UniqueIDBDatabase::isCurrentlyInUse):
(WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired): If the database is not

currently in use, close it.

(WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted):

Modules/indexeddb/server/UniqueIDBDatabase.h:

(WebCore::IDBServer::UniqueIDBDatabase::deletePending): Deleted.

Modules/indexeddb/shared/IDBObjectStoreInfo.cpp:

(WebCore::IDBObjectStoreInfo::isolatedCopy): Actually get this right.

LayoutTests:

platform/mac-wk1/TestExpectations:
storage/indexeddb/modern/256-open-databases-expected.txt: Added.
storage/indexeddb/modern/256-open-databases.html: Added.
storage/indexeddb/modern/exceed-open-file-limit-expected.txt: Added.
storage/indexeddb/modern/exceed-open-file-limit.html: Added.
storage/indexeddb/modern/resources/256-open-databases.js: Added.
storage/indexeddb/modern/resources/exceed-open-file-limit.js: Added.

4:21 PM Changeset in webkit [197473] by Matt Baker

7 edits in trunk/Source/WebInspectorUI

Web Inspector: Timelines UI redesign: add the timelines tree outline to the TimelineOverview
https://bugs.webkit.org/show_bug.cgi?id=153034
<rdar://problem/24195628>

Reviewed by Timothy Hatcher.

Move the Timelines tree outline to the overview, in preparation for <https://webkit.org/b/153036>.

UserInterface/Views/OverviewTimelineView.css:

(.timeline-view.overview > .timeline-ruler > .header): Deleted.
(.timeline-view.overview > .timeline-ruler > .event-markers): Deleted.
These are now part of the default ruler style.

UserInterface/Views/TimelineOverview.css:

(.timeline-overview > .tree-outline.timelines):
(.timeline-overview > .tree-outline.timelines::before):
(body.window-inactive .timeline-overview > .tree-outline.timelines):
(.timeline-overview.frames > .tree-outline.timelines):
(.timeline-overview > .tree-outline.timelines .close-button):
(.timeline-overview > .tree-outline.timelines .item.selected .close-button):
(.timeline-overview > .tree-outline.timelines .item:not(.selected):nth-child(even)):
(.timeline-overview > .tree-outline.timelines .item:not(.selected):not(:first-child)):
(.timeline-overview > .tree-outline.timelines .item.selected + .item):
(body.window-inactive .timeline-overview > .tree-outline.timelines .item.selected + .item):
(.timeline-overview > .tree-outline.timelines :focus .item.selected + .item):
(.timeline-overview > .scroll-container):
(.timeline-overview.frames > .scroll-container):
(.timeline-overview > .timeline-ruler):
(.timeline-overview.frames > .timeline-ruler):
(.timeline-overview > .timeline-ruler > .markers):
(.timeline-overview > .graphs-container):
(.timeline-overview.frames > .graphs-container):
Styles for the timelines tree outline. A content element is inserted before the
tree to fill the gap created by the timeline ruler. For now the tree has a fixed
width of 185px, and is hidden when displaying the FPS instrument.

UserInterface/Views/TimelineOverview.js:

(WebInspector.TimelineOverview):
(WebInspector.TimelineOverview.prototype.get selectedTimeline):
(WebInspector.TimelineOverview.prototype.set selectedTimeline):
Make the selected timeline accessible to the parent view, since the overview doesn't
have a "represented object", or receive ContentView change notifications.

(WebInspector.TimelineOverview.prototype._instrumentAdded):
(WebInspector.TimelineOverview.prototype._instrumentRemoved):
(WebInspector.TimelineOverview.prototype._viewModeDidChange):
Add and remove instrument tree elements. Each tree element is created with a height
equal to it's overview graph, and is shown/hidden based on the current view mode.

(WebInspector.TimelineOverview.prototype._timelinesTreeSelectionDidChange):
Update the selected timeline and dispatch change event.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView):
(WebInspector.TimelineRecordingContentView.prototype._currentContentViewDidChange):
(WebInspector.TimelineRecordingContentView.prototype._updateTimelineOverviewHeight):
(WebInspector.TimelineRecordingContentView.prototype._timelineSelected):
Sync the overview's timeline selection with the current ContentView's represented object.

UserInterface/Views/TimelineRuler.css:

(.timeline-ruler > .header):
(.timeline-ruler > .header > .divider > .label):
(.timeline-ruler > .selection-drag):
(.timeline-ruler > .selection-handle):
Ruler height changed to 23px, to be consistent with the DataGrid header.

UserInterface/Views/TreeOutline.css:

(.tree-outline.large .item .icon):
Large icon style updated to match TimelineSidebarPanel.css. The 32px
size is outdated and no longer used.

UserInterface/Views/Variables.css:

(:root):
New color variables, used by TimelineOverview.css.

4:19 PM Changeset in webkit [197472] by barraclough@apple.com

2 edits in trunk/Source/WebCore

Disable timer throttling increases for visually idle / active pages.
https://bugs.webkit.org/show_bug.cgi?id=154935

Reviewed by Chris Dumez.

Currently any page that is visually idle can timer throttle, and all are eligible for throttling
allow throttling to increase.

Instead, still allow any visually idle page to timer throttle, but only allow increasing in those
that are fully hidden & inactive (no page loading or media activity).

page/Page.cpp:

(WebCore::Page::setTimerThrottlingState):

Updated policy per commet above.

(WebCore::Page::setPageActivityState):
(WebCore::Page::setIsVisible):

We now may need to updated timer throttling when these change.

4:17 PM Changeset in webkit [197471] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline fast/transforms/bounding-rect-zoom.html for ios-simulator after r197450

Unreviewed test gardening.

platform/ios-simulator/fast/transforms/bounding-rect-zoom-expected.txt:

4:10 PM Changeset in webkit [197470] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-forms.html for ios-simulator after r197458

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:

3:48 PM Changeset in webkit [197469] by Beth Dakin

3 edits in trunk/Source/WebKit2

Crashes in media tests after http://trac.webkit.org/changeset/197461
https://bugs.webkit.org/show_bug.cgi?id=154933

Reviewed by Eric Carlson.

Since the controlsManagerInterface is not guaranteed to exist, it doesn't
make sense to return a reference. Return a pointer instead.

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.h:
UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::isVisible):
(WebKit::WebVideoFullscreenManagerProxy::controlsManagerInterface):
(WebKit::WebVideoFullscreenManagerProxy::fullscreenMayReturnToInline):

2:45 PM Changeset in webkit [197468] by commit-queue@webkit.org

8 edits in trunk

[cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
https://bugs.webkit.org/show_bug.cgi?id=154651

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-03-02
Reviewed by Alex Christensen.

Source/cmake/WebKitMacros.cmake: Used phony target instead of

CMake's PRE_BUILD COMMAND feature because the latter actually
generates pre-link target instead of pre-build.

Source/JavaScriptCore:

CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

Source/WebCore:

No new tests needed.

CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

Source/WTF:

CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

2:39 PM Changeset in webkit [197467] by sbarati@apple.com

17 edits in trunk/Source/JavaScriptCore

SetPrototypeOf should be a fully virtual method in ClassInfo::methodTable
https://bugs.webkit.org/show_bug.cgi?id=154897

Reviewed by Filip Pizlo.

This patch makes us more consistent with how the ES6 specification models the
SetPrototypeOf trap. Moving this method into ClassInfo::methodTable
is a prerequisite for implementing Proxy.SetPrototypeOf. This patch
still allows directly setting the prototype for situations where this
is the desired behavior. This is equivalent to setting the internal
Prototype field as described in the specification.

API/JSClassRef.cpp:

(OpaqueJSClass::prototype):

API/JSObjectRef.cpp:

(JSObjectMake):
(JSObjectSetPrototype):
(JSObjectHasProperty):

API/JSWrapperMap.mm:

(makeWrapper):

runtime/ClassInfo.h:
runtime/IntlCollatorConstructor.cpp:

(JSC::constructIntlCollator):

runtime/IntlDateTimeFormatConstructor.cpp:

(JSC::constructIntlDateTimeFormat):

runtime/IntlNumberFormatConstructor.cpp:

(JSC::constructIntlNumberFormat):

runtime/JSCell.cpp:

(JSC::JSCell::isExtensible):
(JSC::JSCell::setPrototypeOf):

runtime/JSCell.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::resetPrototype):

runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoSetter):

runtime/JSObject.cpp:

(JSC::JSObject::switchToSlowPutArrayStorage):
(JSC::JSObject::setPrototypeDirect):
(JSC::JSObject::setPrototypeWithCycleCheck):
(JSC::JSObject::setPrototypeOf):
(JSC::JSObject::allowsAccessFrom):
(JSC::JSObject::setPrototype): Deleted.

runtime/JSObject.h:

(JSC::JSObject::setPrototypeOfInline):
(JSC::JSObject::mayInterceptIndexedAccesses):

runtime/JSProxy.cpp:

(JSC::JSProxy::setTarget):

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorSetPrototypeOf):

runtime/ReflectObject.cpp:

(JSC::reflectObjectSetPrototypeOf):

2:37 PM Changeset in webkit [197466] by rniwa@webkit.org

1 edit
2 adds in trunk/LayoutTests

Add a custom element test for synchronous element construction in HTML parser
https://bugs.webkit.org/show_bug.cgi?id=154932

Reviewed by Antti Koivisto.

Added a test.

fast/custom-elements/parser/parser-constructs-custom-element-synchronously-expected.txt: Added.
fast/custom-elements/parser/parser-constructs-custom-element-synchronously.html: Added.

2:30 PM Changeset in webkit [197465] by fpizlo@apple.com

1 edit
3 adds in trunk/LayoutTests

Add a benchmark for string transcoding.

Rubber stamped by Saam Barati.

I wrote some code like this while working on
https://github.com/WebAssembly/design/pull/573. I thought I'd add it as a benchmark since
it stresses things that we may not have good bench coverage for.

js/regress/script-tests/string-transcoding.js: Added.

(decodeUTF8):
(encodeUTF8):
(arraysEqual):
(arrayToString):
(setHeader):
(print):
(tryArray):
(doSteps):

js/regress/string-transcoding-expected.txt: Added.
js/regress/string-transcoding.html: Added.

2:29 PM Changeset in webkit [197464] by hyatt@apple.com

9 edits
4 adds in trunk

Add support for the "first" value of the hanging-punctuation property.
https://bugs.webkit.org/show_bug.cgi?id=154919

Reviewed by Simon Fraser.

Source/WebCore:

New tests added in fast/text.

Implement the "first" value for hanging-punctuation as described here:
https://drafts.csswg.org/css-text-3/#propdef-hanging-punctuation

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):
Update the preferred logical width computation to factor in hanging punctuation.
This check is similar to the text-indent logic in that we only want to do it for
the first formatted line.

rendering/RenderBlockFlow.h:

(WebCore::RenderBlockFlow::simpleLineLayout):
Make sure to turn off simple line layout when hanging punctuation is present. Eventually
it should be feasible to support this in simple line layout, but since the full line
layout model has to work with it anyway, we are starting there.

rendering/RenderBlockLineLayout.cpp:

(WebCore::inlineAncestorHasStartBorderPaddingOrMargin):
(WebCore::isLastInFlowRun):
Helper functions that are needed to determine whether or not we're allowed to apply
hanging punctuation "first" to a text run.

(WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
This function manipulates logicalLeft and availableWidth when hanging punctuation
is present to shift the line as needed and to expand the availableWidth of the line.

rendering/RenderText.cpp:

(WebCore::isHangablePunctuationAtLineStart):
(WebCore::isHangablePunctuationAtLineEnd):
(WebCore::RenderText::hangablePunctuationStartWidth):
(WebCore::RenderText::trimmedPrefWidths):

rendering/RenderText.h:

RenderText has a helper function for handing back the hangable punctuation width. This
is used everywhere line layout wants to apply that offset. There are also helper functions
that detect whether the character is a hangable punctuation character.

rendering/SimpleLineLayout.cpp:

(WebCore::SimpleLineLayout::canUseForWithReason):
(WebCore::SimpleLineLayout::printReason):
Turn off simple line layout when hanging punctuation is enabled.

rendering/line/BreakingContext.h:

(WebCore::BreakingContext::handleText):
Modified to expand the available width when hanging punctuation is present so that we
know we have more room on the line.

rendering/line/LineWidth.h:

(WebCore::LineWidth::isFirstLine):
Add an accessor for whether or not we're the first line.

LayoutTests:

fast/text/hanging-punctuation-first-expected.html: Added.
fast/text/hanging-punctuation-first-rtl-expected.html: Added.
fast/text/hanging-punctuation-first-rtl.html: Added.
fast/text/hanging-punctuation-first.html: Added.

1:56 PM Changeset in webkit [197463] by rniwa@webkit.org

12 edits
9 adds in trunk

Make HTML parser construct custom elements
https://bugs.webkit.org/show_bug.cgi?id=154908
Source/WebCore:

<rdar://problem/24923735>

Reviewed by Antti Koivisto.

Added the support for instantiating custom elements inside the parser. Based on Jan F2F discussion,
the HTML parser is going to synchronously construct custom elements. When a custom element constructor
throws, the HTML parser creates a HTMLUnknownElement instead.

In our implementation, we pause the parser completely and construct custom elements using the same
mechanism used to run author scripts. It's possible that we may want to apply some optimizations to
to make custom element construction but it's probably a good idea to get semantics right first.

Tests: fast/custom-elements/parser/parser-constructs-custom-elements.html

fast/custom-elements/parser/parser-fallsback-to-unknown-element.html
fast/custom-elements/parser/parser-sets-attributes-and-children.html
fast/custom-elements/parser/parser-uses-constructed-element.html

bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::constructElement): Added ShouldClearException as an argument
to be used by the HTML parser since the parser can't re-throw to anywhere or fail parsing.

bindings/js/JSCustomElementInterface.h:

(WebCore::JSCustomElementInterface::ShouldClearException): Added.

dom/Document.cpp:

(WebCore::createHTMLElementWithNameValidation): Do not clear the exception here since createElement
must re-throw the exception thrown by a custom element constructor.
(WebCore::Document::createElementForBindings):

dom/make_names.pl:

(printFactoryCppFile): Added ConstructorFunctionMapEntry which contains the constructor function
as well as the qualified name.
(printFactoryHeaderFile): Added a variant of createKnownElement and createElement that takes
AtomicString instead of QualifiedName.

html/parser/HTMLConstructionSite.cpp:

(WebCore::setAttributes): Added a variant that takes Vector<Attribute>.
(WebCore::HTMLConstructionSite::insertHTMLElementOrFindCustomElementInterface): Added. Returns a
custom element interface when the element doesn't match any builtin element and there is a custom
element definition that matches the specified name.
(WebCore::HTMLConstructionSite::insertCustomElement): Added. Like insertElement but also sets the
attributes on the newly created custom element.
(WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface): Extracted from
createHTMLElement. When customElementInterface is not nullptr, we optionally find the custom
element interface and return nullptr.
(WebCore::HTMLConstructionSite::createHTMLElement):

html/parser/HTMLConstructionSite.h:

html/parser/HTMLDocumentParser.cpp:

(WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Create a custom element when there
is a pending custom element to create (i.e. m_customElementToConstruct is not empty).
(WebCore::HTMLDocumentParser::isWaitingForScripts):

html/parser/HTMLStackItem.h:

(WebCore::HTMLStackItem::create): Added a variant used for custom elements.
(WebCore::HTMLStackItem::HTMLStackItem): Ditto.

html/parser/HTMLTreeBuilder.cpp:

(WebCore::CustomElementConstructionData::CustomElementConstructionData): Added. It needs to be in
the cpp file to avoid introducing more header dependencies in HTMLTreeBuilder.h.
(WebCore::CustomElementConstructionData::~CustomElementConstructionData): Ditto.
(WebCore::HTMLTreeBuilder::processStartTagForInBody): Use insertGenericHTMLElement when creating
a generic element that could be custom elements.
(WebCore::HTMLTreeBuilder::insertGenericHTMLElement): Added. Create and insert a new element
or set m_customElementToConstruct so that the HTMLDocumentParser will create a custom element later.
(WebCore::HTMLTreeBuilder::didCreateCustomOrCallbackElement): Added. Called by HTMLDocumentParser
when it finishes creating a new custom element.

html/parser/HTMLTreeBuilder.h:

(WebCore::HTMLTreeBuilder::takeCustomElementConstructionData): Added.
(WebCore::HTMLTreeBuilder::hasParserBlockingScriptWork): Renamed from hasParserBlockingScript.
Checks the existence of m_customElementToConstruct as well as m_scriptToProcess.

LayoutTests:

Reviewed by Antti Koivisto.

Added W3C testharness.js based tests for instantiating custom elements inside the HTML parser.

fast/custom-elements/parser: Added.
fast/custom-elements/parser/parser-constructs-custom-elements-expected.txt: Added.
fast/custom-elements/parser/parser-constructs-custom-elements.html: Added.
fast/custom-elements/parser/parser-fallsback-to-unknown-element-expected.txt: Added.
fast/custom-elements/parser/parser-fallsback-to-unknown-element.html: Added.
fast/custom-elements/parser/parser-sets-attributes-and-children-expected.txt: Added.
fast/custom-elements/parser/parser-sets-attributes-and-children.html: Added.
fast/custom-elements/parser/parser-uses-constructed-element-expected.txt: Added.
fast/custom-elements/parser/parser-uses-constructed-element.html: Added.

1:42 PM Changeset in webkit [197462] by Alan Bujtas

13 edits in trunk/Source/WebCore

Use IndentTextOrNot instead of passing isFirstLine/shouldIndentText as bool.
https://bugs.webkit.org/show_bug.cgi?id=154628

Reviewed by Simon Fraser.

No change in behaviour.

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
(WebCore::RenderBlock::logicalLeftSelectionOffset):
(WebCore::RenderBlock::logicalRightSelectionOffset):

rendering/RenderBlock.h:

(WebCore::RenderBlock::availableLogicalWidthForLineInRegion):
(WebCore::RenderBlock::logicalRightOffsetForLineInRegion):
(WebCore::RenderBlock::logicalLeftOffsetForLineInRegion):
(WebCore::RenderBlock::startOffsetForLineInRegion):
(WebCore::RenderBlock::endOffsetForLineInRegion):
(WebCore::RenderBlock::availableLogicalWidthForLine):
(WebCore::RenderBlock::logicalRightOffsetForLine):
(WebCore::RenderBlock::logicalLeftOffsetForLine):
(WebCore::RenderBlock::startOffsetForLine):
(WebCore::RenderBlock::endOffsetForLine):

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::getClearDelta):

rendering/RenderBlockLineLayout.cpp:

(WebCore::updateLogicalInlinePositions):
(WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
(WebCore::RenderBlockFlow::deleteEllipsisLineBoxes):
(WebCore::RenderBlockFlow::checkLinesForTextOverflow):
(WebCore::RenderBlockFlow::startAlignedOffsetForLine):

rendering/RenderBox.cpp:

(WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
(WebCore::RenderBox::containingBlockAvailableLineWidthInRegion):

rendering/RenderDeprecatedFlexibleBox.cpp:

(WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):

rendering/RenderListItem.cpp:

(WebCore::RenderListItem::positionListMarker):

rendering/RootInlineBox.cpp:

(WebCore::RootInlineBox::selectionTop):
(WebCore::RootInlineBox::selectionBottom):

rendering/SimpleLineLayout.cpp:

(WebCore::SimpleLineLayout::canUseForWithReason):
(WebCore::SimpleLineLayout::updateLineConstrains):

rendering/line/LineBreaker.cpp:

(WebCore::LineBreaker::skipLeadingWhitespace):

rendering/line/LineWidth.cpp:

(WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded):
(WebCore::availableWidthAtOffset):

rendering/line/LineWidth.h:

(WebCore::LineWidth::shouldIndentText):

12:59 PM Changeset in webkit [197461] by Beth Dakin

24 edits in trunk/Source

Add support for playbackControlsManager
https://bugs.webkit.org/show_bug.cgi?id=154742
-and corresponding-
rdar://problem/23833753

Reviewed by Jer Noble.

Source/WebCore:

Make AVKitSPI.h private so that it can be used from other projects.

WebCore.xcodeproj/project.pbxproj:

Right now, set up a controls manager for a video when it starts playing. In
the future, this is something that should be handled by the
PlatformMediaSessionManager since we only want a controls for the
currentSession.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::playInternal):

New function setUpVideoControlsManager.

page/ChromeClient.h:

Make these CoreMedia functions available on Mac and iOS instead of just iOS.

platform/cf/CoreMediaSoftLink.cpp:
platform/cf/CoreMediaSoftLink.h:

This patch fleshes out an implementation for a bunch of these interface
functions since they need to communicate to the playbackControlsManager. This
is also where the playbackControlsManager lives.

platform/mac/WebVideoFullscreenInterfaceMac.h:

Define an interface and implementation for WebPlaybackControlsManager.

platform/mac/WebVideoFullscreenInterfaceMac.mm:

(-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):
(-[WebPlaybackControlsManager isSeeking]):
(-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]):
(-[WebPlaybackControlsManager audioMediaSelectionOptions]):
(-[WebPlaybackControlsManager currentAudioMediaSelectionOption]):
(-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
(-[WebPlaybackControlsManager legibleMediaSelectionOptions]):
(-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]):
(-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):
(-[WebPlaybackControlsManager cancelThumbnailAndAudioAmplitudeSampleGeneration]):

Relay this information to the playbackControlsManager.
(WebCore::WebVideoFullscreenInterfaceMac::setDuration):
(WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime):
(WebCore::WebVideoFullscreenInterfaceMac::setRate):
(WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges):
(WebCore::WebVideoFullscreenInterfaceMac::ensureControlsManager):
(WebCore::WebVideoFullscreenInterfaceMac::playBackControlsManager):
(WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):

New SPI needed.

platform/spi/cocoa/AVKitSPI.h:
platform/spi/mac/AVFoundationSPI.h:

Source/WebKit2:

WebVideoFullscreenManagerProxy ensures the model and interface for the
UIProcess side of the playbackControlsManager. It also caches the
m_controlsManagerContextId so that it can return the
controlsManagerInterface.

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.h:
UIProcess/Cocoa/WebVideoFullscreenManagerProxy.messages.in:
UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::setUpVideoControlsManagerWithID):
(WebKit::WebVideoFullscreenManagerProxy::controlsManagerInterface):

Pipe isPlayingMediaDidChange() to WebViewImpl, and use that information to
update WebViewImplAdditions.

UIProcess/Cocoa/WebViewImpl.h:
UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::isPlayingMediaDidChange):

UIProcess/PageClient.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::isPlayingMediaDidChange):
(WebKit::WebPageProxy::isPlayingVideoWithAudio):

UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::isPlayingAudio):

UIProcess/mac/PageClientImpl.h:
UIProcess/mac/PageClientImpl.mm:

(WebKit::PageClientImpl::isPlayingMediaDidChange):

Pipe setUpVideoControlsManager to the WebVideoFullscreenManager.

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::setUpVideoControlsManager):

WebProcess/WebCoreSupport/WebChromeClient.h:

Ensure the model an interface for the playbackControlsManager on the
WebProcess side and pass the message to the UIProcess to do the same.

WebProcess/cocoa/WebVideoFullscreenManager.h:
WebProcess/cocoa/WebVideoFullscreenManager.mm:

(WebKit::WebVideoFullscreenManager::setUpVideoControlsManager):

12:49 PM Changeset in webkit [197460] by Ryan Haddad

2 edits in branches/safari-601-branch/LayoutTests

Merge r194336. rdar://problem/24935448

12:39 PM Changeset in webkit [197459] by barraclough@apple.com

3 edits in trunk/Source/WebCore

Add Page::TimerThrottlingState
https://bugs.webkit.org/show_bug.cgi?id=154926

Reviewed by Chris Dumez.

Hidden page timer throttling is currently a boolean state, indicated by whether the Optional
m_timerThrottlingEnabledTime is in a set/unset state. When enabled, the increasing mechanism
may or may not be enabled, this is controlled directly by the setting.

Refactor to add an enum tracking timer throttling being in one of three states - disabled,
enabled, or enabled-increasing. This cleans things up, and will enabled up to introduce a
dynamic policy for when enabled-throttling is enabled. (Behavior is unchanged in this patch.)

page/Page.cpp:

(WebCore::Page::Page):
(WebCore::Page::setIsVisuallyIdleInternal):
(WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged):

setTimerThrottlingEnabled -> updateTimerThrottlingState.

(WebCore::Page::updateTimerThrottlingState):

policy decision (currently enabled if visually-idle) was scattered across all call sites to setTimerThrottlingState. Unify in one place.

(WebCore::Page::setTimerThrottlingState):

Was setTimerThrottlingEnabled.

(WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
(WebCore::Page::setDOMTimerAlignmentInterval):
(WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):

updated to check m_timerThrottlingState.

(WebCore::Page::setTimerThrottlingEnabled): Deleted.

This became updateTimerThrottlingState.

page/Page.h:

(WebCore::Page::timerThrottlingEnabled): Deleted.

Removed, it's easy enough now to just check m_timerThrottlingState.

12:38 PM Changeset in webkit [197458] by Chris Dumez

17 edits in trunk

Align HTMLInputElement.maxLength with the specification
https://bugs.webkit.org/show_bug.cgi?id=154906

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline W3C tests now that more checks are passing.

web-platform-tests/html/dom/reflection-forms-expected.txt:
web-platform-tests/html/semantics/forms/the-input-element/maxlength-expected.txt:

Source/WebCore:

Align HTMLInputElement.maxLength with the specification:

In particular, the following Web-facing change was made:

HTMLInputElement.maxLength returns -1 instead of 524288 when the corresponding content attribute is missing, cannot be parsed or out of range (i.e. negative), as per:
- https://html.spec.whatwg.org/multipage/infrastructure.html#limited-to-only-non-negative-numbers

Note that HTMLTextAreaElement.maxLength was already returning -1 in
this case.

The new behavior matches Firefox. Chrome however, still seems to
return 524288.

Note that we keep using 524288 as a maximum maxLength internally for
performance reasons. However, we stop exposing this arbitrary value to
the Web as this is an internal limitation.

No new tests, already covered by existing tests.

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::HTMLInputElement):
Initialize m_maxLength to -1 initially, instead of 524288.

(WebCore::HTMLInputElement::tooLong):
Call effectiveMaxLength() instead of maxLength(), which no longer
exists. effectiveMaxLength() makes sure of returning a value in
the range [0, 524288].

(WebCore::HTMLInputElement::parseAttribute):

(WebCore::HTMLInputElement::effectiveMaxLength):
Split maxLength() into maxLengthForBindings() and effectiveMaxLength().
effectiveMaxLength() returns a value in the range [0, 524288], while
maxLengthForBindings() returns values in the range [-1, 2147483647].

(WebCore::HTMLInputElement::setMaxLength): Deleted.
The implementation was moved to the parent class so that it can be
shared with HTMLTextAreaElement.

(WebCore::HTMLInputElement::maxLengthAttributeChanged):
Rename for clarity.

html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::parseAttribute):
(WebCore::HTMLTextAreaElement::maxLengthAttributeChanged):
Cache the parsed maxLength when the content attribute changes, similarly
to what is already done in HTMLInputElement.

(WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
(WebCore::HTMLTextAreaElement::validationMessage):
(WebCore::HTMLTextAreaElement::tooLong):
Call effectiveMaxLength() instead of maxLength() which no longer exists.
effectiveMaxLength() returns a cached value and is therefore a lot more
efficient.

html/HTMLTextAreaElement.h:
html/HTMLTextAreaElement.idl:
html/HTMLTextFormControlElement.cpp:

(WebCore::HTMLTextFormControlElement::setMaxLengthForBindings):
This was moved up from HTMLInputElement / HTMLTextAreaElement to avoid code
duplication.

html/HTMLTextFormControlElement.h:

html/InputType.cpp:

(WebCore::InputType::validationMessage):

html/TextFieldInputType.cpp:

(WebCore::TextFieldInputType::handleBeforeTextInsertedEvent):
Call HTMLInputElement::effectiveMaxLength() instead of
HTMLInputElement::maxLength() which no longer exists.

LayoutTests:

Update test now that input.maxLength initially returns -1
instead of 524288.

fast/forms/input-maxlength-expected.txt:
fast/forms/input-maxlength.html:

11:17 AM Changeset in webkit [197457] by sbarati@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

SIGSEGV in Proxy Get and Set recursion
https://bugs.webkit.org/show_bug.cgi?id=154854

Reviewed by Yusuke Suzuki.

We need to be aware of the possibility that the VM
may recurse and that we can stack overflow.

runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performPut):

tests/stress/proxy-get-and-set-recursion-stack-overflow.js: Added.

(assert):
(testStackOverflowGet):
(testStackOverflowIndexedGet):
(testStackOverflowSet):
(testStackOverflowIndexedSet):

10:54 AM Changeset in webkit [197456] by commit-queue@webkit.org

10 edits in trunk/Source/WebCore

Unreviewed, rolling out r197434 and r197436.
https://bugs.webkit.org/show_bug.cgi?id=154921

This change caused a LayoutTest assertion in debug (Requested
by ryanhaddad on #webkit).

Reverted changesets:

"Extend CSSFontSelector's lifetime to be longer than the
Document's lifetime"
https://bugs.webkit.org/show_bug.cgi?id=154101
http://trac.webkit.org/changeset/197434

"Unreviewed build fix after r197434."
http://trac.webkit.org/changeset/197436

10:31 AM Changeset in webkit [197455] by bshafiei@apple.com

5 edits in trunk/Source

Versioning.

10:29 AM Changeset in webkit [197454] by bshafiei@apple.com

1 copy in tags/Safari-602.1.21

New tag.

10:05 AM Changeset in webkit [197453] by Ryan Haddad

2 edits in branches/safari-601-branch/LayoutTests

Update TestExpectations for media/controls/track-menu.html. rdar://problem/24745197

platform/mac/TestExpectations:

9:59 AM Changeset in webkit [197452] by Carlos Garcia Campos

3 edits in trunk/Source/WebKit2

REGRESSION(r197409): [GTK] Web process always crashes on WebPage construction after r197409
https://bugs.webkit.org/show_bug.cgi?id=154918

Reviewed by Žan Doberšek.

We have an incorrect check in DrawingAreaImpl constructor that has
never actually worked because it uses the page settings before
they were initialized. But that has been fixed in r197409 and now
we are always forcing accelerated compositing mode incorrectly,
because m_alwaysUseCompositing is set in the constructor and never
changed again.

WebProcess/WebPage/DrawingAreaImpl.cpp:

(WebKit::DrawingAreaImpl::DrawingAreaImpl): Remove code to set
settings and m_alwaysUseCompositing, since that should be done in
updatePreferences().
(WebKit::DrawingAreaImpl::updatePreferences): Update the settings
accordingly and always update m_alwaysUseCompositing when AC is
enabled and forced in the settings.

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::WebPage): WebPage::updatePreferences() calls
DrawingArea::updatePreferences(), but since r197409 it happens
before the drawing area has been created. So, call
DrawingArea::updatePreferences() in the constructor right after
the main frame has been created, since
DrawingArea::updatePreferences() uses the main frame.

9:32 AM Changeset in webkit [197451] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Fix the build with VIDEO disabled.

Patch by Milan Crha <mcrha@redhat.com> on 2016-03-02
Reviewed by Carlos Garcia Campos.

platform/gtk/RenderThemeGtk2.cpp:
platform/gtk/RenderThemeGtk3.cpp:

9:16 AM Changeset in webkit [197450] by Alan Bujtas

14 edits
2 adds in trunk

Subpixel layout: Enable vertical/horizontal subpixel spacing for tables.
https://bugs.webkit.org/show_bug.cgi?id=154899

Reviewed by Simon Fraser.

This patch enables authors to specify device pixel values for table border spacing.
(see border-spacing)

Source/WebCore:

Test: fast/table/hidpi-vertical-and-horizontal-spacing.html

css/CSSPropertyNames.in:
page/animation/CSSPropertyAnimation.cpp:

(WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):

rendering/RenderTable.cpp:

(WebCore::RenderTable::offsetLeftForColumn):
(WebCore::RenderTable::offsetWidthForColumn):
(WebCore::RenderTable::RenderTable): Deleted.

rendering/RenderTable.h:
rendering/style/RenderStyle.cpp:

(WebCore::RenderStyle::horizontalBorderSpacing):
(WebCore::RenderStyle::verticalBorderSpacing):
(WebCore::RenderStyle::setHorizontalBorderSpacing):
(WebCore::RenderStyle::setVerticalBorderSpacing):

rendering/style/RenderStyle.h:
rendering/style/StyleInheritedData.h:

LayoutTests:

fast/table/hidpi-vertical-and-horizontal-spacing-expected.html: Added.
fast/table/hidpi-vertical-and-horizontal-spacing.html: Added.

9:12 AM Changeset in webkit [197449] by Chris Dumez

9 edits in trunk/Source/WebCore

Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use WTF::Optional
https://bugs.webkit.org/show_bug.cgi?id=154845

Reviewed by Darin Adler.

Take into consideration review comments made after landing r197389.

html/HTMLElement.cpp:

(WebCore::HTMLElement::parseBorderWidthAttribute):
(WebCore::HTMLElement::parseAttribute):

html/HTMLInputElement.cpp:
html/HTMLInputElement.h:
html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::maxLength):

html/ImageInputType.cpp:

(WebCore::ImageInputType::height):
(WebCore::ImageInputType::width):

html/parser/HTMLParserIdioms.cpp:

(WebCore::parseHTMLNonNegativeInteger):

html/parser/HTMLParserIdioms.h:

(WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
(WebCore::limitToOnlyHTMLNonNegative):

svg/SVGElement.cpp:

(WebCore::SVGElement::parseAttribute):

9:08 AM Changeset in webkit [197448] by jdiggs@igalia.com

8 edits in trunk/LayoutTests

[AX][GTK] Position-related tests need new baseline after r196439
https://bugs.webkit.org/show_bug.cgi?id=154917

The tests in question include the position accessed via the component
interface. The result changed by one pixel after r196439.

Unreviewed gardening.

platform/gtk/accessibility/image-link-expected.txt: new baseline
platform/gtk/accessibility/math-multiscript-attributes-expected.txt: new baseline
platform/gtk/accessibility/table-attributes-expected.txt: new baseline
platform/gtk/accessibility/table-cell-spans-expected.txt: new baseline
platform/gtk/accessibility/table-cells-expected.txt: new baseline
platform/gtk/accessibility/table-detection-expected.txt: new baseline
platform/gtk/accessibility/table-sections-expected.txt: new baseline

5:40 AM Changeset in webkit [197447] by alex

2 edits in trunk/Tools

Unreviewed build fix for media-stream after r197114.

TestWebKitAPI/Tests/WebKit2/UserMedia.cpp:

(TestWebKitAPI::decidePolicyForUserMediaPermissionRequestCallBack):

2:22 AM Changeset in webkit [197446] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

[JSC] Use a Move without REX byte when possible
https://bugs.webkit.org/show_bug.cgi?id=154801

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-03-02
Reviewed by Alex Christensen.

Filip wrote an optimization in the register allocator
to use 32bit "Move" when we don't care about the top bytes.

When I moved the commutative ops to the fake 3 operands instruction
I largely destroyed this since all the "Moves" became full register.

In this patch, I switch back to 32bit "Moves" for 32bit operations.

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::and32):
(JSC::MacroAssemblerX86Common::lshift32):
(JSC::MacroAssemblerX86Common::mul32):
(JSC::MacroAssemblerX86Common::or32):
(JSC::MacroAssemblerX86Common::rshift32):
(JSC::MacroAssemblerX86Common::urshift32):
(JSC::MacroAssemblerX86Common::xor32):
(JSC::MacroAssemblerX86Common::branchAdd32):
(JSC::MacroAssemblerX86Common::branchMul32):
(JSC::MacroAssemblerX86Common::branchSub32):
(JSC::MacroAssemblerX86Common::move32IfNeeded):

Mar 1, 2016:

11:53 PM Changeset in webkit [197445] by benjamin@webkit.org

2 edits
1 add in trunk/Source/JavaScriptCore

[JSC] Simplify ArithMod(ArithMod(x, const1), const2) if const2 >= const1
https://bugs.webkit.org/show_bug.cgi?id=154904

Reviewed by Saam Barati.

The ASM test "ubench" has a "x % 10 % 255".
The second modulo should be eliminated.

This is a 15% improvement on ASMJS' ubench.

dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

tests/stress/arith-modulo-twice.js: Added.

(opaqueModuloSmaller):
(opaqueModuloEqual):
(opaqueModuloLarger):
(opaqueModuloSmallerNeg):
(opaqueModuloEqualNeg):
(opaqueModuloLargerNeg):
(opaqueExpectedOther):

11:12 PM Changeset in webkit [197444] by rniwa@webkit.org

2 edits in trunk/Source/JavaScriptCore

Unreviewed. Update the status of Proxy objects to "In Development".

features.json:

11:06 PM Changeset in webkit [197443] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

Unreviewed. Remove the "Partial Support" status from web components since shadow DOM and custom elements
are in active development.

features.json:

10:58 PM Changeset in webkit [197442] by Csaba Osztrogonác

2 edits in trunk/Tools

Disable FTL JIT testing on 32-bit JSC tester bots
https://bugs.webkit.org/show_bug.cgi?id=154858

Reviewed by Saam Barati.

BuildSlaveSupport/build.webkit.org-config/master.cfg:

(Run32bitJSCTests):

10:56 PM Changeset in webkit [197441] by commit-queue@webkit.org

10 edits
1 add in trunk/Source

Unreviewed, rolling out r197226 and r197256.
https://bugs.webkit.org/show_bug.cgi?id=154910

Caused crashes on Mac 32-bit and on ARM (Requested by ap on
#webkit).

Reverted changesets:

"Remove the on demand executable allocator"
https://bugs.webkit.org/show_bug.cgi?id=154749
http://trac.webkit.org/changeset/197226

"CLoop build fix."
http://trac.webkit.org/changeset/197256

10:53 PM Changeset in webkit [197440] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

Unreviewed. Update the feature status for custom elements API.

features.json:

9:31 PM Changeset in webkit [197439] by rniwa@webkit.org

6 edits
2 adds in trunk

Contents inside a shadow host with a negative tabindex should not be tab focusable
https://bugs.webkit.org/show_bug.cgi?id=154769

Reviewed by Antti Koivisto.

Source/WebCore:

Contents inside a shadow host with a negative tabindex content attribute should not be included in
the sequential focus navigation order as discussed on https://github.com/w3c/webcomponents/issues/399.

Test: fast/shadow-dom/negative-tabindex-on-shadow-host.html

dom/Element.cpp:

(WebCore::Element::tabIndexSetExplicitly): Added.

dom/Element.h:
page/FocusController.cpp:

(WebCore::shadowAdjustedTabIndex): Renamed from adjustedTabIndex. Return 0 when tabindex content attribute
is not explicitly set since element.tabIndex() would return -1 for HTML elements in such case.
(WebCore::isFocusableOrHasShadowTreeWithoutCustomFocusLogic): Renamed from shouldVisit.
(WebCore::FocusController::findElementWithExactTabIndex):
(WebCore::nextElementWithGreaterTabIndex):
(WebCore::previousElementWithLowerTabIndex):
(WebCore::FocusController::nextFocusableElement):
(WebCore::FocusController::previousFocusableElement):

LayoutTests:

Added a test for navigating across shadow boundaries.

fast/shadow-dom/negative-tabindex-on-shadow-host-expected.txt: Added.
fast/shadow-dom/negative-tabindex-on-shadow-host.html: Added.
platform/ios-simulator/TestExpectations:

8:30 PM Changeset in webkit [197438] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

Simplify some StringBuilder appends
https://bugs.webkit.org/show_bug.cgi?id=154902

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-01
Reviewed by Mark Lam.

runtime/ExceptionHelpers.cpp:

(JSC::notAFunctionSourceAppender):

runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::stackTracesAsJSON):
Use StringBuilder::append(char) instead of append(char*) where possible.

7:22 PM Changeset in webkit [197437] by msaboff@apple.com

2 edits in trunk/Source/WebCore

REGRESSION (r197426): Missed adding unicode parameter to call to Yarr::parse() in URLFilterParser::addPattern()
https://bugs.webkit.org/show_bug.cgi?id=154898

Reviewed by Saam Barati.

This is a fix for the API tests after r197426.

Added missing bool unicode parameter of "false".

contentextensions/URLFilterParser.cpp:

(WebCore::ContentExtensions::URLFilterParser::addPattern):

6:53 PM Changeset in webkit [197436] by mmaxfield@apple.com

2 edits in trunk/Source/WebCore

Unreviewed build fix after r197434.

Unreviewed

css/SourceSizeList.cpp:

(WebCore::parseSizesAttribute):

6:50 PM Changeset in webkit [197435] by mmaxfield@apple.com

3 edits
2 adds
2 deletes in trunk

Small-caps non-BMP characters are garbled in the complex text codepath
https://bugs.webkit.org/show_bug.cgi?id=154875

Reviewed by Michael Saboff.

Source/WebCore:

We were assuming that all characters able to be capitalized are in BMP. This is not true.

Test: fast/text/complex-small-caps-non-bmp-capitalize.html

platform/graphics/mac/ComplexTextController.cpp:

(WebCore::capitalized):
(WebCore::ComplexTextController::collectComplexTextRuns):

LayoutTests:

fast/text/complex-small-caps-non-bmp-capitalize-expected.html: Added.
fast/text/complex-small-caps-non-bmp-capitalize.html: Added.
fast/text/regress-154875-expected.txt: Deleted
fast/text/regress-154875.html: Deleted

6:34 PM Changeset in webkit [197434] by mmaxfield@apple.com

10 edits in trunk/Source/WebCore

Extend CSSFontSelector's lifetime to be longer than the Document's lifetime
https://bugs.webkit.org/show_bug.cgi?id=154101

Reviewed by Darin Adler.

Rather than destroying the Document's CSSFontSelector, instead, the object should
live for the lifetime of the document, and it should instead be asked to clear its
contents.

This is important for the CSS Font Loading API, where the identity of objects the
CSSFontSelector references needs to persist throughout the lifetime of the
Document. This patch represents the first step to implementing this correctly.
The second step is for the CSSFontSelector to perform a diff instead of a
wholesale clear of its contents. Once this is done, font loading objects can
survive through a call to Document::clearStyleResolver().

This patch gives the CSSFontSelector two states: building underway and building not
underway. The state is building underway in between calls to clearStyleResolver()
and when the style resolver gets built back up. Otherwise, the state is building
not underway. Because of this new design, creation of all FontFace objects can be
postponed until a state transition from building underway to building not underway.
A subsequent patch will perform the diff at this point. An ASSERT() makes sure that
we never service a font lookup request while Building.

No new tests because there is no behavior change.

css/CSSFontFaceSet.cpp:

(WebCore::CSSFontFaceSet::clear):

css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::buildStarted):
(WebCore::CSSFontSelector::buildCompleted):
(WebCore::CSSFontSelector::addFontFaceRule):
(WebCore::CSSFontSelector::fontRangesForFamily):
(WebCore::CSSFontSelector::CSSFontSelector): Deleted.
(WebCore::CSSFontSelector::clearDocument): Deleted.

css/CSSFontSelector.h:
css/StyleResolver.cpp:

(WebCore::StyleResolver::appendAuthorStyleSheets):

dom/Document.cpp:

(WebCore::Document::Document):
(WebCore::Document::~Document):
(WebCore::Document::clearStyleResolver):
(WebCore::Document::fontSelector): Deleted.

dom/Document.h:

(WebCore::Document::fontSelector):

6:28 PM Changeset in webkit [197433] by ap@apple.com

3 edits in trunk/Source/WebCore

Update Xcode project for InstallAPI
https://bugs.webkit.org/show_bug.cgi?id=154896
rdar://problem/24825992

Patch by Daniel Dunbar, reviewed by me.

Configurations/WebCore.xcconfig:
WebCore.xcodeproj/project.pbxproj:

6:16 PM Changeset in webkit [197432] by adachan@apple.com

2 edits in trunk/Source/WebCore

One more attempt to fix the build.

platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:

(WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):

6:07 PM Changeset in webkit [197431] by adachan@apple.com

2 edits in trunk/Source/WebCore

Attempt to fix the internal build.

platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:

(WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):

5:43 PM Changeset in webkit [197430] by commit-queue@webkit.org

2 edits in trunk/Tools

Fix iOS EWS.
https://bugs.webkit.org/show_bug.cgi?id=154880

Patch by Dean Johnson <dean_johnson@apple.com> on 2016-03-01
Reviewed by Alexey Proskuryakov.

Scripts/copy-webkitlibraries-to-product-directory:

5:15 PM Changeset in webkit [197429] by adachan@apple.com

39 edits in trunk/Source

Adopt the new version of AVOutputDeviceMenuController's showMenuForRect method.
https://bugs.webkit.org/show_bug.cgi?id=154823

Reviewed by Tim Horton.

Source/WebCore:

Modules/mediasession/WebMediaSessionManager.cpp:

(WebCore::WebMediaSessionManager::showPlaybackTargetPicker):
(WebCore::WebMediaSessionManager::customPlaybackActionSelected):
Call customPlaybackActionSelected() on the client that requested the picker.

Modules/mediasession/WebMediaSessionManager.h:
Modules/mediasession/WebMediaSessionManagerClient.h:
dom/Document.cpp:

(WebCore::Document::showPlaybackTargetPicker):
(WebCore::Document::customPlaybackActionSelected):

dom/Document.h:
html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::customPlaybackActionSelected):
(WebCore::HTMLMediaElement::playbackTargetPickerCustomActionName):

html/HTMLMediaElement.h:
html/MediaElementSession.cpp:

(WebCore::MediaElementSession::showPlaybackTargetPicker):
(WebCore::MediaElementSession::customPlaybackActionSelected):

html/MediaElementSession.h:
page/ChromeClient.h:
page/Page.cpp:

(WebCore::Page::showPlaybackTargetPicker):
(WebCore::Page::customPlaybackActionSelected):

page/Page.h:
platform/audio/PlatformMediaSession.h:

(WebCore::PlatformMediaSessionClient::customPlaybackActionSelected):

platform/graphics/MediaPlaybackTargetClient.h:
platform/graphics/MediaPlaybackTargetPicker.cpp:

(WebCore::MediaPlaybackTargetPicker::pendingActionTimerFired):
(WebCore::MediaPlaybackTargetPicker::showPlaybackTargetPicker):

platform/graphics/MediaPlaybackTargetPicker.h:

(WebCore::MediaPlaybackTargetPicker::Client::customPlaybackActionSelected):
(WebCore::MediaPlaybackTargetPicker::customPlaybackActionSelected):

platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.h:
platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:

Update the forward declaration of AVOutputDeviceMenuController's showMenuForRect method.
(WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):
Call the new version of showMenuForRect if available.

platform/mac/WebVideoFullscreenInterfaceMac.h:
platform/mac/WebVideoFullscreenInterfaceMac.mm:

(WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback):

platform/mock/MediaPlaybackTargetPickerMock.cpp:

(WebCore::MediaPlaybackTargetPickerMock::showPlaybackTargetPicker):

platform/mock/MediaPlaybackTargetPickerMock.h:
platform/spi/cocoa/AVKitSPI.h:

Updated with the new version of showMenuForRect.

Source/WebKit/mac:

WebCoreSupport/WebChromeClient.h:
WebCoreSupport/WebChromeClient.mm:

(WebChromeClient::showPlaybackTargetPicker):

WebView/WebMediaPlaybackTargetPicker.h:
WebView/WebMediaPlaybackTargetPicker.mm:

(WebMediaPlaybackTargetPicker::showPlaybackTargetPicker):
(WebMediaPlaybackTargetPicker::customPlaybackActionSelected):

WebView/WebView.mm:

(-[WebView _showPlaybackTargetPicker:location:hasVideo:]):

Source/WebKit2:

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::showPlaybackTargetPicker):
(WebKit::WebPageProxy::customPlaybackActionSelected):

UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:
WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::showPlaybackTargetPicker):

WebProcess/WebCoreSupport/WebChromeClient.h:
WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:
WebProcess/WebPage/mac/WebPageMac.mm:

(WebKit::WebPage::customPlaybackActionSelected):

5:08 PM Changeset in webkit [197428] by keith_miller@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

Promise.prototype.then should use Symbol.species to construct the return Promise
https://bugs.webkit.org/show_bug.cgi?id=154862

Reviewed by Saam Barati.

builtins/PromisePrototype.js:
tests/stress/promise-species-functions.js: Added.

(Symbol.species):
(id):
(funcThrows):
(makeC):
(test.species):
(test.speciesThrows):
(test):

5:02 PM Changeset in webkit [197427] by Brent Fulgham

5 edits in trunk/Source/WebKit2

[WK2] Stub support for WebsiteDataTypeResourceLoadStatistics
https://bugs.webkit.org/show_bug.cgi?id=154689
<rdar://problem/24702576>

Reviewed by Sam Weinig.

Shared/WebsiteData/WebsiteDataType.h: Add new WebsiteDataTypeResourceLoadStatistics.
UIProcess/API/Cocoa/WKWebsiteDataRecord.mm:

(dataTypesToString): Handle new type.

UIProcess/API/Cocoa/WKWebsiteDataRecordInternal.h:

(WebKit::toWebsiteDataTypes): Ditto.
(WebKit::toWKWebsiteDataTypes): Ditto.

UIProcess/API/Cocoa/WKWebsiteDataRecordPrivate.h: Add new _WebsiteDataTypeResourceLoadStatistics.

4:39 PM Changeset in webkit [197426] by msaboff@apple.com

27 edits
3 moves
3 adds in trunk

[ES6] Add support for Unicode regular expressions
https://bugs.webkit.org/show_bug.cgi?id=154842

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Added processing of Unicode regular expressions to the Yarr interpreter.

Changed parsing of regular expression patterns and PatternTerms to process characters as
UChar32 in the Yarr code. The parser converts matched surrogate pairs into the appropriate
Unicode character when the expression is parsed. When matching a unicode expression and
reading source characters, we convert proper surrogate pair into a Unicode character and
advance the source cursor, "pos", one more position. The exception to this is when we
know when generating a fixed character atom that we need to match a unicode character
that doesn't fit in 16 bits. The code calls this an extendedUnicodeCharacter and has a
helper to determine this.

Added 'u' flag and 'unicode' identifier to regular expression classes. Added an "isUnicode"
parameter to YarrPattern pattern() and internal users of that function.

Updated the generation of the canonicalization tables to include a new set a tables that
follow the ES 6.0, 21.2.2.8.2 Step 2. Renamed the YarrCanonicalizeUCS2.* files to
YarrCanonicalizeUnicode.*.

Added a new Layout/js test that tests the added functionality. Updated other tests that
have minor es6 unicode checks and look for valid flags.

Ran the ChakraCore Unicode regular expression tests as well.

CMakeLists.txt:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
JavaScriptCore.xcodeproj/project.pbxproj:

inspector/ContentSearchUtilities.cpp:

(Inspector::ContentSearchUtilities::findMagicComment):

yarr/RegularExpression.cpp:

(JSC::Yarr::RegularExpression::Private::compile):
Updated use of pattern().

runtime/CommonIdentifiers.h:
runtime/RegExp.cpp:

(JSC::regExpFlags):
(JSC::RegExpFunctionalTestCollector::outputOneTest):
(JSC::RegExp::finishCreation):
(JSC::RegExp::compile):
(JSC::RegExp::compileMatchOnly):

runtime/RegExp.h:
runtime/RegExpKey.h:
runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncCompile):
(JSC::flagsString):
(JSC::regExpProtoGetterMultiline):
(JSC::regExpProtoGetterUnicode):
(JSC::regExpProtoGetterFlags):
Updated for new 'y' (unicode) flag. Add check to use the interpreter for unicode regular expressions.

tests/es6.yaml:
tests/stress/static-getter-in-names.js:

Updated tests for new flag and for passing the minimal es6 regular expression processing.

yarr/Yarr.h: Updated the size of information now kept for backtracking.

yarr/YarrCanonicalizeUCS2.cpp: Removed.
yarr/YarrCanonicalizeUCS2.h: Removed.
yarr/YarrCanonicalizeUCS2.js: Removed.
yarr/YarrCanonicalizeUnicode.cpp: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.cpp.
yarr/YarrCanonicalizeUnicode.h: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.h.

(JSC::Yarr::canonicalCharacterSetInfo):
(JSC::Yarr::canonicalRangeInfoFor):
(JSC::Yarr::getCanonicalPair):
(JSC::Yarr::isCanonicallyUnique):
(JSC::Yarr::areCanonicallyEquivalent):
(JSC::Yarr::rangeInfoFor): Deleted.

yarr/YarrCanonicalizeUnicode.js: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.js.

(printHeader):
(printFooter):
(hex):
(canonicalize):
(canonicalizeUnicode):
(createUCS2CanonicalGroups):
(createUnicodeCanonicalGroups):
(cu.in.groupedCanonically.characters.sort): Deleted.
(cu.in.groupedCanonically.else): Deleted.
Refactored to output two sets of tables, one for UCS2 and one for Unicode. The UCS2 tables follow
the legacy canonicalization rules now specified in ES 6.0, 21.2.2.8.2 Step 3. The new Unicode
tables follow the rules specified in ES 6.0, 21.2.2.8.2 Step 2. Eliminated the unused Latin1 tables.

yarr/YarrInterpreter.cpp:

(JSC::Yarr::Interpreter::InputStream::InputStream):
(JSC::Yarr::Interpreter::InputStream::readChecked):
(JSC::Yarr::Interpreter::InputStream::readSurrogatePairChecked):
(JSC::Yarr::Interpreter::InputStream::reread):
(JSC::Yarr::Interpreter::InputStream::prev):
(JSC::Yarr::Interpreter::testCharacterClass):
(JSC::Yarr::Interpreter::checkCharacter):
(JSC::Yarr::Interpreter::checkSurrogatePair):
(JSC::Yarr::Interpreter::checkCasedCharacter):
(JSC::Yarr::Interpreter::tryConsumeBackReference):
(JSC::Yarr::Interpreter::backtrackPatternCharacter):
(JSC::Yarr::Interpreter::matchCharacterClass):
(JSC::Yarr::Interpreter::backtrackCharacterClass):
(JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
(JSC::Yarr::Interpreter::matchDisjunction):
(JSC::Yarr::Interpreter::Interpreter):
(JSC::Yarr::ByteCompiler::assertionWordBoundary):
(JSC::Yarr::ByteCompiler::atomPatternCharacter):

yarr/YarrInterpreter.h:

(JSC::Yarr::ByteTerm::ByteTerm):
(JSC::Yarr::BytecodePattern::BytecodePattern):

yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::optimizeAlternative):
(JSC::Yarr::YarrGenerator::matchCharacterClassRange):
(JSC::Yarr::YarrGenerator::matchCharacterClass):
(JSC::Yarr::YarrGenerator::notAtEndOfInput):
(JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
(JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
(JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
(JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):

yarr/YarrParser.h:

(JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
(JSC::Yarr::Parser::Parser):
(JSC::Yarr::Parser::parseEscape):
(JSC::Yarr::Parser::consumePossibleSurrogatePair):
(JSC::Yarr::Parser::parseCharacterClass):
(JSC::Yarr::Parser::parseTokens):
(JSC::Yarr::Parser::parse):
(JSC::Yarr::Parser::atEndOfPattern):
(JSC::Yarr::Parser::patternRemaining):
(JSC::Yarr::Parser::peek):
(JSC::Yarr::parse):

yarr/YarrPattern.cpp:

(JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
(JSC::Yarr::CharacterClassConstructor::append):
(JSC::Yarr::CharacterClassConstructor::putChar):
(JSC::Yarr::CharacterClassConstructor::putUnicodeIgnoreCase):
(JSC::Yarr::CharacterClassConstructor::putRange):
(JSC::Yarr::CharacterClassConstructor::charClass):
(JSC::Yarr::CharacterClassConstructor::addSorted):
(JSC::Yarr::CharacterClassConstructor::addSortedRange):
(JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
(JSC::Yarr::YarrPatternConstructor::assertionWordBoundary):
(JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
(JSC::Yarr::YarrPatternConstructor::atomCharacterClassBegin):
(JSC::Yarr::YarrPatternConstructor::atomCharacterClassAtom):
(JSC::Yarr::YarrPatternConstructor::atomCharacterClassRange):
(JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
(JSC::Yarr::YarrPattern::compile):
(JSC::Yarr::YarrPattern::YarrPattern):

yarr/YarrPattern.h:

(JSC::Yarr::CharacterRange::CharacterRange):
(JSC::Yarr::CharacterClass::CharacterClass):
(JSC::Yarr::PatternTerm::PatternTerm):
(JSC::Yarr::YarrPattern::reset):

yarr/YarrSyntaxChecker.cpp:

(JSC::Yarr::SyntaxChecker::assertionBOL):
(JSC::Yarr::SyntaxChecker::assertionEOL):
(JSC::Yarr::SyntaxChecker::assertionWordBoundary):
(JSC::Yarr::SyntaxChecker::atomPatternCharacter):
(JSC::Yarr::SyntaxChecker::atomBuiltInCharacterClass):
(JSC::Yarr::SyntaxChecker::atomCharacterClassBegin):
(JSC::Yarr::SyntaxChecker::atomCharacterClassAtom):
(JSC::Yarr::checkSyntax):

LayoutTests:

Added a new test for the added unicode regular expression processing.

Updated several tests for the y flag changes and "unicode" property.

js/regexp-unicode-expected.txt: Added.
js/regexp-unicode.html: Added.
js/script-tests/regexp-unicode.js: Added.

New test.

js/Object-getOwnPropertyNames-expected.txt:
js/regexp-flags-expected.txt:
js/script-tests/Object-getOwnPropertyNames.js:
js/script-tests/regexp-flags.js:

(RegExp.prototype.hasOwnProperty):
Updated tests.

4:31 PM Changeset in webkit [197425] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking fast/text/crash-complex-text-surrogate.html as flaky on mac
https://bugs.webkit.org/show_bug.cgi?id=154709

Unreviewed test gardening.

platform/mac/TestExpectations:

4:01 PM Changeset in webkit [197424] by dbates@webkit.org

2 edits in trunk/Source/WebCore

com.apple.WebKit.Networking.Development crashes in WebCore::formOpen()
https://bugs.webkit.org/show_bug.cgi?id=154682
<rdar://problem/23550269>

Reviewed by Brent Fulgham.

Speculative fix for a race condition when opening the stream for the next form data element.
Calling CFReadStreamOpen(s) in WebCore::openNextStream() can cause stream s to be closed and
deallocated before CFReadStreamOpen(s) returns.

When WebCore::openNextStream() is called it closes and deallocates the current stream and
then opens a new stream for the next form data element. Calling CFReadStreamOpen() in
WebCore::openNextStream() can lead to WebCore::openNextStream() being re-entered via
WebCore::formEventCallback() from another thread. One example when this can occur is when
the stream being opened has no data (i.e. WebCore::formEventCallback() is called
back with event type kCFStreamEventEndEncountered).

I have been unable to reproduce this crash. We know that it occurs from crash reports.

platform/network/cf/FormDataStreamCFNet.cpp:

(WebCore::closeCurrentStream): Assert that we had acquired a lock to close the stream.
(WebCore::advanceCurrentStream): Assert that we had acquired a lock to advance the stream.
(WebCore::openNextStream): Acquire a lock before we open the next stream to ensure that
exactly one thread executes this critical section at a time.
(WebCore::formFinalize): Acquire a lock before we close the current stream.
(WebCore::formClose): Ditto.

4:00 PM Changeset in webkit [197423] by msaboff@apple.com

3 edits
2 adds in trunk

ASSERT in platform/graphics/mac/ComplexTextController.cpp::capitalize()
https://bugs.webkit.org/show_bug.cgi?id=154875

Reviewed by Myles C. Maxfield.

Source/WebCore:

Change an ASSERT to verify that uper casing a character doesn't change its size.

Test: fast/text/regress-154875.html

platform/graphics/mac/ComplexTextController.cpp:

(WebCore::capitalized):

LayoutTests:

New test.

fast/text/regress-154875-expected.txt: Added.
fast/text/regress-154875.html: Added.

3:58 PM Changeset in webkit [197422] by sbarati@apple.com

2 edits in trunk/Source/JavaScriptCore

Remove FIXMEs and add valid test cases after necessary patch has landed.

Rubber stamped by Mark Lam.

tests/stress/proxy-prevent-extensions.js:

(assert.Object.isSealed):
(assert):

3:57 PM Changeset in webkit [197421] by Ryan Haddad

2 edits in branches/safari-601-branch/LayoutTests

Rebaseline fast/css/will-change-parsing.html. rdar://problem/24743200

fast/css/will-change-parsing-expected.txt:

3:51 PM Changeset in webkit [197420] by sbarati@apple.com

4 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Implement Proxy.IsExtensible
https://bugs.webkit.org/show_bug.cgi?id=154872

Reviewed by Oliver Hunt.

This patch is a direct implementation of Proxy.IsExtensible with respect to section 9.5.3
of the ECMAScript 6 spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible

runtime/ProxyObject.cpp:

(JSC::ProxyObject::preventExtensions):
(JSC::ProxyObject::performIsExtensible):
(JSC::ProxyObject::isExtensible):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h:
tests/es6.yaml:
tests/stress/proxy-is-extensible.js: Added.

(assert):
(throw.new.Error.let.handler.get isExtensible):
(throw.new.Error):
(assert.let.handler.isExtensible):
(assert.):
(let.handler.isExtensible):

3:44 PM Changeset in webkit [197419] by Ryan Haddad

2 edits in branches/safari-601-branch/LayoutTests

Update TesetExpectations for fast/text/multiple-feature-properties.html. rdar://problem/24494562

platform/mac/TestExpectations:

3:42 PM Changeset in webkit [197418] by sbarati@apple.com

4 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Implement Proxy.PreventExtensions
https://bugs.webkit.org/show_bug.cgi?id=154873

Reviewed by Oliver Hunt.

This patch is a direct implementation of Proxy.PreventExtensions with respect to section 9.5.4
of the ECMAScript 6 spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-preventextensions

runtime/ProxyObject.cpp:

(JSC::ProxyObject::deletePropertyByIndex):
(JSC::ProxyObject::performPreventExtensions):
(JSC::ProxyObject::preventExtensions):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h:
tests/es6.yaml:
tests/stress/proxy-prevent-extensions.js: Added.

(assert):
(throw.new.Error.let.handler.get preventExtensions):
(throw.new.Error):
(assert.let.handler.preventExtensions):
(assert.):
(let.handler.preventExtensions):
(assert.Object.isSealed.let.handler.preventExtensions):
(assert.Object.isSealed):

3:40 PM Changeset in webkit [197417] by fpizlo@apple.com

1 edit
3 adds in trunk/LayoutTests

FTL should simplify StringReplace with an empty replacement string
https://bugs.webkit.org/show_bug.cgi?id=154871

Reviewed by Michael Saboff.

Really add this new test.

js/regress/script-tests/string-replace-empty.js: Added.
js/regress/string-replace-empty-expected.txt: Added.
js/regress/string-replace-empty.html: Added.

3:35 PM Changeset in webkit [197416] by fpizlo@apple.com

5 edits in trunk

FTL should simplify StringReplace with an empty replacement string
https://bugs.webkit.org/show_bug.cgi?id=154871

Reviewed by Michael Saboff.

This is a simple and hugely profitable change. If we do a string.replace(/things/, ""), then
this calls directly into StringPrototype's replace-with-empty-string logic instead of going
through stuff that does checks before reaching that same conclusion.

This speeds up Octane/regexp by about 6-10%. It also speeds up the attached microbenchmark by
about 7%.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):

runtime/StringPrototype.cpp:

(JSC::jsSpliceSubstringsWithSeparators):
(JSC::removeUsingRegExpSearch):
(JSC::replaceUsingRegExpSearch):
(JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
(JSC::operationStringProtoFuncReplaceRegExpString):

runtime/StringPrototype.h:

3:33 PM Changeset in webkit [197415] by barraclough@apple.com

2 edits in trunk/Source/WebCore

Timer alignment in separate web processes should not all sync up to the same point.
https://bugs.webkit.org/show_bug.cgi?id=154878

Reviewed by Chris Dumez.

For any given WebContent process it is desirable that timers are synchronized to a single
alignment point, but if all WebContent processes align to the same point then there may
be a thundering herd of processes waking up.

page/DOMTimer.cpp:

(WebCore::DOMTimer::alignedFireTime):

align to a randomized point.

2:29 PM Changeset in webkit [197414] by commit-queue@webkit.org

10 edits in trunk

Reduce size of internal windows build output
https://bugs.webkit.org/show_bug.cgi?id=154763

Patch by Alex Christensen <achristensen@webkit.org> on 2016-03-01
Reviewed by Brent Fulgham.

Source/cmake/OptionsWin.cmake:

Source/JavaScriptCore:

JavaScriptCore.vcxproj/JavaScriptCore.proj:

Source/WebCore:

WebCore.vcxproj/WebCore.proj:

Source/WebKit:

WebKit.vcxproj/WebKit.proj:

Source/WTF:

WTF.vcxproj/WTF.proj:

2:13 PM Changeset in webkit [197413] by achristensen@apple.com

5 edits in trunk/Source/WebKit2

Correctly keep track of NetworkDataTasks with and without credentials when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154876

Reviewed by Brady Eidson.

I was seeing an assertion failure from ASSERT(!m_session.m_dataTaskMap.contains(taskIdentifier()))
in the NetworkDataTask constructor sometimes. This is because a task identifier is not enough information
to uniquely find a NetworkDataTask in a NetworkSession since r196034 because there are two NSURLSessions
in a NetworkSession, one with credentials and one without. The assertion would fire in a case like if we
made the first NetworkDataTask with credentials (taskIdentifier is 1) and the first NetworkDataTask
without credentials before the first NetworkDataTask with credentials was finished. In that case, the
taskIdentifier would also be 1, which would conflict with the other taskIdentifier. That taskIdentifier
would uniquely identify the task in the correct NSURLSession, though, so the solution is to keep a map
for each NSURLSession in the NetworkSession.

NetworkProcess/NetworkDataTask.h:
NetworkProcess/NetworkSession.h:
NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::NetworkDataTask):
(WebKit::NetworkDataTask::~NetworkDataTask):
(WebKit::NetworkDataTask::suspend):
(WebKit::serverTrustCredential):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:didSendBodyData:totalBytesSent:totalBytesExpectedToSend:]):
(-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didCompleteWithError:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveData:]):
(-[WKNetworkSessionDelegate URLSession:downloadTask:didWriteData:totalBytesWritten:totalBytesExpectedToWrite:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didBecomeDownloadTask:]):
(WebKit::NetworkSession::clearCredentials):
(WebKit::NetworkSession::dataTaskForIdentifier):
(WebKit::NetworkSession::addDownloadID):

1:45 PM Changeset in webkit [197412] by sbarati@apple.com

14 edits in trunk/Source/JavaScriptCore

IsExtensible should be a virtual method in the method table
https://bugs.webkit.org/show_bug.cgi?id=154799

Reviewed by Mark Lam.

This patch makes us more consistent with how the ES6 specification models the
IsExtensible trap. Moving this method into ClassInfo::methodTable
is a prerequisite for implementing Proxy.IsExtensible.

runtime/ClassInfo.h:
runtime/JSCell.cpp:

(JSC::JSCell::preventExtensions):
(JSC::JSCell::isExtensible):

runtime/JSCell.h:
runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoSetter):

runtime/JSObject.cpp:

(JSC::JSObject::preventExtensions):
(JSC::JSObject::isExtensible):
(JSC::JSObject::reifyAllStaticProperties):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
(JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
(JSC::JSObject::defineOwnNonIndexProperty):
(JSC::JSObject::defineOwnProperty):

runtime/JSObject.h:

(JSC::JSObject::isSealed):
(JSC::JSObject::isFrozen):
(JSC::JSObject::isExtensibleImpl):
(JSC::JSObject::isStructureExtensible):
(JSC::JSObject::isExtensibleInline):
(JSC::JSObject::indexingShouldBeSparse):
(JSC::JSObject::putDirectInternal):
(JSC::JSObject::isExtensible): Deleted.

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorSetPrototypeOf):
(JSC::objectConstructorIsSealed):
(JSC::objectConstructorIsFrozen):
(JSC::objectConstructorIsExtensible):
(JSC::objectConstructorIs):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):

runtime/ReflectObject.cpp:

(JSC::reflectObjectIsExtensible):
(JSC::reflectObjectSetPrototypeOf):

runtime/SparseArrayValueMap.cpp:

(JSC::SparseArrayValueMap::putEntry):
(JSC::SparseArrayValueMap::putDirect):

runtime/StringObject.cpp:

(JSC::StringObject::defineOwnProperty):

runtime/Structure.cpp:

(JSC::Structure::isSealed):
(JSC::Structure::isFrozen):

runtime/Structure.h:

1:40 PM Changeset in webkit [197411] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix CLOOP build.

jit/JITOperations.h:

1:28 PM Changeset in webkit [197410] by gskachkov@gmail.com

6 edits in trunk/Source/JavaScriptCore

[ES6] Arrow function. Some not used byte code is emited
https://bugs.webkit.org/show_bug.cgi?id=154639

Reviewed by Saam Barati.

Currently bytecode that is generated for arrow function is not optimal.
Current fix removed following unnecessary bytecode:
1.create_lexical_environment not emited always for arrow function, only if some of
features(this/super/arguments/eval) is used inside of the arrow function.
2.load 'this' from arrow function scope in constructor is done only if super
contains in arrow function

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::isSuperCallUsedInInnerArrowFunction):

bytecompiler/BytecodeGenerator.h:
bytecompiler/NodesCodegen.cpp:

(JSC::ThisNode::emitBytecode):
(JSC::FunctionNode::emitBytecode):

parser/Nodes.h:

(JSC::ScopeNode::doAnyInnerArrowFunctionsUseAnyFeature):

tests/stress/arrowfunction-lexical-bind-supercall-4.js:

1:20 PM Changeset in webkit [197409] by akling@apple.com

5 edits in trunk/Source

REGRESSION (r154616): Accelerated drawing is off during the initial load
<https://webkit.org/b/123812>

Reviewed by Tim Horton.

Source/WebCore:

Robustify the hey-the-Settings-changed callbacks in Page to handle document-less frames.
This is needed because now Settings are changed even before the main Frame has a Document.

page/Page.cpp:

(WebCore::networkStateChanged):
(WebCore::Page::updateStyleForAllPagesAfterGlobalChangeInEnvironment):
(WebCore::Page::takeAnyMediaCanStartListener):
(WebCore::Page::setMediaVolume):
(WebCore::Page::setPageScaleFactor):
(WebCore::Page::invalidateStylesForAllLinks):
(WebCore::Page::invalidateStylesForLink):
(WebCore::Page::dnsPrefetchingStateChanged):
(WebCore::Page::storageBlockingStateChanged):
(WebCore::Page::setMuted):
(WebCore::Page::captionPreferencesChanged):
(WebCore::Page::setSessionID):
(WebCore::Page::setPlaybackTarget):
(WebCore::Page::playbackTargetAvailabilityDidChange):
(WebCore::Page::setShouldPlayToPlaybackTarget):

page/Settings.cpp:

(WebCore::setImageLoadingSettings):

Source/WebKit2:

Load preferences before instantiating the first DrawingArea. This ensures that we do the
initial paint using accelerated drawing, and avoids allocating persistent data structures
only needed by the software rendering path.

WebProcess/WebPage/WebPage.cpp:

1:18 PM Changeset in webkit [197408] by fpizlo@apple.com

28 edits
3 adds in trunk

Turn String.prototype.replace into an intrinsic
https://bugs.webkit.org/show_bug.cgi?id=154835

Reviewed by Michael Saboff.

Source/JavaScriptCore:

Octane/regexp spends a lot of time in String.prototype.replace(). That function does a lot
of checks to see if the parameters are what they are likely to often be (a string, a
regexp, and a string). The intuition of this patch is that it's good to remove those checks
and it's good to call the native function as directly as possible.

This yields a 10% speed-up on a replace microbenchmark and a 3% speed-up on Octane/regexp.
It also improves Octane/jquery.

This is only the beginning of what I want to do with replace optimizations. The other
optimizations will rely on StringReplace being revealed as a construct in DFG IR.

JavaScriptCore.xcodeproj/project.pbxproj:
bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):
(JSC::speculationToAbbreviatedString):
(JSC::speculationFromClassInfo):

bytecode/SpeculatedType.h:

(JSC::isStringOrStringObjectSpeculation):
(JSC::isRegExpObjectSpeculation):
(JSC::isBoolInt32Speculation):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateStringOrStringObject):
(JSC::DFG::Node::shouldSpeculateRegExpObject):
(JSC::DFG::Node::shouldSpeculateSymbol):

dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculateFinalObject):
(JSC::DFG::SpeculativeJIT::speculateRegExpObject):
(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
(JSC::DFG::SpeculativeJIT::speculate):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGUseKind.cpp:

(WTF::printInternal):

dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::isCell):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
(JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateFinalObject):
(JSC::FTL::DFG::LowerDFGToB3::speculateRegExpObject):
(JSC::FTL::DFG::LowerDFGToB3::speculateString):

jit/JITOperations.h:
runtime/Intrinsic.h:
runtime/JSType.h:
runtime/RegExpObject.h:

(JSC::RegExpObject::createStructure):

runtime/StringPrototype.cpp:

(JSC::StringPrototype::finishCreation):
(JSC::removeUsingRegExpSearch):
(JSC::replaceUsingRegExpSearch):
(JSC::operationStringProtoFuncReplaceRegExpString):
(JSC::replaceUsingStringSearch):
(JSC::stringProtoFuncRepeat):
(JSC::replace):
(JSC::stringProtoFuncReplace):
(JSC::operationStringProtoFuncReplaceGeneric):
(JSC::stringProtoFuncToString):

runtime/StringPrototype.h:

LayoutTests:

js/regress/script-tests/string-replace.js: Added.
js/regress/string-replace-expected.txt: Added.
js/regress/string-replace.html: Added.

12:00 PM Changeset in webkit [197407] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

Fix tests when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154866

Reviewed by Brady Eidson.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::globalCustomProtocolManager):
(WebKit::NetworkSession::setCustomProtocolManager):

Use a static NeverDestroyed instead of a local NeverDestroyed.
This fix was suggested by Darin after I broke the custom protocol tests in r197362.

(WebKit::NetworkSession::clearCredentials):

In r197223 I added code that I thought cleared the credentials of a session, but it was
actually trying (and failing) to remove the credentials from the NSURLCredentialStorage that
were stored with NSURLCredentialPersistencePermanent.
This was causing credentials stored in an NSURLSession with NSURLCredentialPersistenceForSession
to remain for the next tests, and was causing credentials from previous tests, usually from
http/tests/loading/basic-credentials-sent-automatically.html, to be used in future tests.
Creating a new NSURLSession is the equivalent of CredentialStorage::clearCredentials because it
removes all credentials stored with NSURLCredentialPersistenceForSession.

11:47 AM Changeset in webkit [197406] by commit-queue@webkit.org

8 edits in trunk

Unreviewed, rolling out r197056.
https://bugs.webkit.org/show_bug.cgi?id=154870

broke win ews (Requested by alexchristensen on #webkit).

Reverted changeset:

"[cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK."
https://bugs.webkit.org/show_bug.cgi?id=154651
http://trac.webkit.org/changeset/197056

11:41 AM Changeset in webkit [197405] by beidson@apple.com

4 edits in trunk/Source/WebCore

Modern IDB: Possible crash deallocating IDBDatabaseInfo/IDBObjectStoreInfo/IDBIndexInfo.
https://bugs.webkit.org/show_bug.cgi?id=154860

Reviewed by Alex Christensen.

Covered by existing tests.

Modules/indexeddb/shared/IDBDatabaseInfo.cpp:

(WebCore::IDBDatabaseInfo::IDBDatabaseInfo):
(WebCore::IDBDatabaseInfo::isolatedCopy):

Modules/indexeddb/shared/IDBDatabaseInfo.h:

Modules/indexeddb/shared/IDBTransactionInfo.cpp:

(WebCore::IDBTransactionInfo::isolatedCopy): If there's an IDBDatabaseInfo to copy, that

copy needs to be isolated.

10:49 AM Changeset in webkit [197404] by timothy_horton@apple.com

8 edits in trunk/Source

Expose MediaElement and VideoElement to the Objective-C DOM bindings
https://bugs.webkit.org/show_bug.cgi?id=154830

Reviewed by Sam Weinig.

Source/WebCore:

Modules/mediasession/HTMLMediaElementMediaSession.idl:
Modules/mediastream/HTMLMediaElementMediaStream.idl:
html/HTMLMediaElement.idl:
html/HTMLVideoElement.idl:

Avoid Objective-C bindings for various extraneous bits, like MediaSource and MediaSession,
to avoid exposing way more than we need to.

WebCore.xcodeproj/project.pbxproj:

Add a bunch of Derived Sources.

Source/WebKit/mac:

MigrateHeaders.make:

10:33 AM Changeset in webkit [197403] by Ryan Haddad

3 edits in trunk/LayoutTests

Rebaseline isplaylists/extent-includes tests for mac-wk1

Unreviewed test gardening.

platform/mac-wk1/displaylists/extent-includes-shadow-expected.txt:
platform/mac-wk1/displaylists/extent-includes-transforms-expected.txt:

9:42 AM Changeset in webkit [197402] by Carlos Garcia Campos

2 edits in trunk/Source/WebKit2

NetworkCache: Web process leaks resource buffer when using shareable reasources
https://bugs.webkit.org/show_bug.cgi?id=154852

Reviewed by Darin Adler.

ResourceLoader::didReceiveBuffer() expects a PassRefPtr, but we
are passing a raw pointer making PassRefPtr to take another
reference instead of transfering the ownership as expected.

WebProcess/Network/WebResourceLoader.cpp:

(WebKit::WebResourceLoader::didReceiveResource):

9:33 AM Changeset in webkit [197401] by Antti Koivisto

22 edits in trunk/Source/WebCore

Text control shadow element style shouldn't depend on renderers
https://bugs.webkit.org/show_bug.cgi?id=154855

Reviewed by Andreas Kling.

Currently the code for computing style for text control shadow elements lives in render tree.
Style is the input for building a render tree and should be computable without having one.

Fix by moving virtual createInnerTextStyle() from RenderTextControl hierarchy to the DOM side
HTMLTextFormControlElement hierarchy.

dom/Element.cpp:

(WebCore::Element::didDetachRenderers):
(WebCore::Element::customStyleForRenderer):

Also pass shadow host style as it is needed for text controls.

dom/Element.h:
dom/PseudoElement.cpp:

(WebCore::PseudoElement::clearHostElement):
(WebCore::PseudoElement::customStyleForRenderer):

dom/PseudoElement.h:
html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::setRangeText):
(WebCore::HTMLInputElement::createInnerTextStyle):
(WebCore::HTMLInputElement::setupDateTimeChooserParameters):

html/HTMLInputElement.h:
html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::willRespondToMouseClickEvents):
(WebCore::HTMLTextAreaElement::createInnerTextStyle):

html/HTMLTextAreaElement.h:
html/HTMLTextFormControlElement.cpp:

(WebCore::HTMLTextFormControlElement::directionForFormData):
(WebCore::HTMLTextFormControlElement::adjustInnerTextStyle):

html/HTMLTextFormControlElement.h:

(WebCore::HTMLTextFormControlElement::cachedSelectionDirection):

html/shadow/TextControlInnerElements.cpp:

(WebCore::TextControlInnerElement::create):
(WebCore::TextControlInnerElement::customStyleForRenderer):
(WebCore::TextControlInnerTextElement::renderer):
(WebCore::TextControlInnerTextElement::customStyleForRenderer):

html/shadow/TextControlInnerElements.h:
rendering/RenderTextControl.cpp:

(WebCore::RenderTextControl::styleDidChange):
(WebCore::RenderTextControl::textBlockLogicalHeight):
(WebCore::RenderTextControl::adjustInnerTextStyle): Deleted.

rendering/RenderTextControl.h:
rendering/RenderTextControlMultiLine.cpp:

(WebCore::RenderTextControlMultiLine::baselinePosition):
(WebCore::RenderTextControlMultiLine::layoutSpecialExcludedChild):
(WebCore::RenderTextControlMultiLine::createInnerTextStyle): Deleted.

createInnerTextStyle moves to HTMLTextAreaElement::createInnerTextStyle

rendering/RenderTextControlMultiLine.h:
rendering/RenderTextControlSingleLine.cpp:

(WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):

Remove m_desiredInnerTextLogicalHeight cache. It doesn't work, it is never valid when hit.

(WebCore::RenderTextControlSingleLine::layout):
(WebCore::RenderTextControlSingleLine::styleDidChange):
(WebCore::RenderTextControlSingleLine::computeControlLogicalHeight):
(WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
(WebCore::RenderTextControlSingleLine::createInnerTextStyle): Deleted.
(WebCore::RenderTextControlSingleLine::createInnerBlockStyle): Deleted.

createInnerTextStyle moves to HTMLInputElement::createInnerTextStyle
createInnerBlockStyle moves to TextControlInnerElement::customStyleForRenderer

rendering/RenderTextControlSingleLine.h:

(WebCore::RenderTextControlSingleLine::centerContainerIfNeeded):
(WebCore::RenderTextControlSingleLine::containerElement):

style/StyleTreeResolver.cpp:

(WebCore::Style::TreeResolver::styleForElement):

svg/SVGElement.cpp:

(WebCore::SVGElement::synchronizeSystemLanguage):
(WebCore::SVGElement::customStyleForRenderer):

svg/SVGElement.h:

8:54 AM Changeset in webkit [197400] by Manuel Rego Casasnovas

8 edits in trunk/Source/WebCore

[css-grid] Get rid of GridResolvedPosition
https://bugs.webkit.org/show_bug.cgi?id=154818

Reviewed by Darin Adler.

GridResolvedPosition was a small class just wrapping a unsigned.
In the future it should actually wrap an integer,
as we want to support implicit tracks before the explicit grid.

The class itself is not providing any benefit,
so we can get rid of it and store directly 2 unsigned in GridSpan.

This will make simpler future changes related to this task.

We keep the class just as a utility for the methods
that deal with the positions resolution.
But it should be renamed in a follow-up patch.

No new tests, no change of behavior.

css/CSSGridTemplateAreasValue.cpp:

(WebCore::stringForPosition):

css/CSSParser.cpp:

(WebCore::CSSParser::parseGridTemplateAreasRow):

css/StyleBuilderConverter.h:

(WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
(WebCore::RenderGrid::findFlexFactorUnitSize):
(WebCore::RenderGrid::spanningItemCrossesFlexibleSizedTracks):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForItems):
(WebCore::RenderGrid::insertItemIntoGrid):
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
(WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
(WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
(WebCore::RenderGrid::gridAreaBreadthForChild):
(WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
(WebCore::RenderGrid::columnAxisOffsetForChild):
(WebCore::RenderGrid::rowAxisOffsetForChild):

rendering/style/GridCoordinate.h:

(WebCore::GridSpan::definiteGridSpan):
(WebCore::GridSpan::integerSpan):
(WebCore::GridSpan::resolvedInitialPosition):
(WebCore::GridSpan::resolvedFinalPosition):
(WebCore::GridSpan::GridSpanIterator::GridSpanIterator):
(WebCore::GridSpan::GridSpanIterator::operator*):
(WebCore::GridSpan::GridSpanIterator::operator++):
(WebCore::GridSpan::GridSpanIterator::operator!=):
(WebCore::GridSpan::begin):
(WebCore::GridSpan::end):
(WebCore::GridSpan::GridSpan):

rendering/style/GridResolvedPosition.cpp:

(WebCore::resolveNamedGridLinePositionFromStyle):
(WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveGridPositionAgainstOppositePosition):
(WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
(WebCore::resolveGridPositionFromStyle):
(WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):

rendering/style/GridResolvedPosition.h:

(WebCore::GridResolvedPosition::GridResolvedPosition): Deleted.
(WebCore::GridResolvedPosition::operator*): Deleted.
(WebCore::GridResolvedPosition::operator++): Deleted.
(WebCore::GridResolvedPosition::operator==): Deleted.
(WebCore::GridResolvedPosition::operator!=): Deleted.
(WebCore::GridResolvedPosition::operator<): Deleted.
(WebCore::GridResolvedPosition::operator>): Deleted.
(WebCore::GridResolvedPosition::operator<=): Deleted.
(WebCore::GridResolvedPosition::operator>=): Deleted.
(WebCore::GridResolvedPosition::toInt): Deleted.
(WebCore::GridResolvedPosition::next): Deleted.
(WebCore::GridResolvedPosition::prev): Deleted.

6:29 AM Changeset in webkit [197399] by akling@apple.com

2 edits in trunk/Source/WebCore

MemoryCache::forEachResource() should guard resources across function invocation.
<https://webkit.org/b/154846>

Reviewed by Antti Koivisto.

It occurred to me that we should protect the CachedResources from being
deleted while invoking the custom function here, lest we create a giant footgun.

loader/cache/MemoryCache.cpp:

(WebCore::MemoryCache::forEachResource):

3:58 AM Changeset in webkit [197398] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

[Mac][cmake] One more unreviewed speculative buildfix after r197375. Just for fun.

PlatformMac.cmake:

3:17 AM Changeset in webkit [197397] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

[Mac][cmake] Unreviewed speculative buildfix after r197375. Just for fun.

PlatformMac.cmake:

2:34 AM Changeset in webkit [197396] by youenn.fablet@crf.canon.fr

8 edits in trunk

[Fetch API] Support Request and Response blob() when body data is a blob
https://bugs.webkit.org/show_bug.cgi?id=154820

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Adding blob specific tests. New tests are not covered yet as they require converting data from a blob into another form (JSON, text...).
Rebasing expectations with test that is now passing and new failing tests.
Fixing typos in test (Json -> JSON and removing TextDecoder use).

web-platform-tests/fetch/api/request/request-consume-expected.txt:
web-platform-tests/fetch/api/request/request-consume.html:
web-platform-tests/fetch/api/response/response-consume-expected.txt:
web-platform-tests/fetch/api/response/response-consume.html:

Source/WebCore:

Adding support for returning the same Blob that is stored in Body in case JS blob() is called.
Adding support for Blob creation when data is stored as text.
Updated JSDOMBinding and JSDOMPromise to return a JS ArrayBuffer for Vector<char> as well as Vector<unsigned char>.

Covered by added tests.

Modules/fetch/FetchBody.cpp:

(WebCore::FetchBody::arrayBuffer):
(WebCore::FetchBody::blob):
(WebCore::FetchBody::extractFromText):

Modules/fetch/FetchBody.h:
bindings/js/JSDOMBinding.h:

(WebCore::toJS):

bindings/js/JSDOMPromise.h:

(WebCore::DeferredWrapper::resolve): Deleted.

1:05 AM Changeset in webkit [197395] by Carlos Garcia Campos

1 copy in releases/WebKitGTK/webkit-2.11.91

WebKitGTK+ 2.11.91

1:03 AM Changeset in webkit [197394] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.11.91 release.

Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

gtk/NEWS: Add release notes for 2.11.91.

1:03 AM Changeset in webkit [197393] by Carlos Garcia Campos

10 edits
1 add in releases/WebKitGTK/webkit-2.12/Source

Revert "Merge r197226 - Remove the on demand executable allocator"

This reverts commit 3380464fbd83e408a06904221206c9bd1cafe2e6.

1:02 AM Changeset in webkit [197392] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197256 - CLoop build fix."

This reverts commit d6136b81fc3f561214c85ccf3e69a4109963bae9.

12:11 AM Changeset in webkit [197391] by sbarati@apple.com

12 edits in trunk/Source/JavaScriptCore

PreventExtensions should be a virtual method in the method table.
https://bugs.webkit.org/show_bug.cgi?id=154800

Reviewed by Yusuke Suzuki.

This patch makes us more consistent with how the ES6 specification models the
PreventExtensions trap. Moving this method into ClassInfo::methodTable
is a prerequisite for implementing Proxy.PreventExtensions.

runtime/ClassInfo.h:
runtime/JSCell.cpp:

(JSC::JSCell::getGenericPropertyNames):
(JSC::JSCell::preventExtensions):

runtime/JSCell.h:
runtime/JSModuleNamespaceObject.cpp:

(JSC::JSModuleNamespaceObject::JSModuleNamespaceObject):
(JSC::JSModuleNamespaceObject::finishCreation):
(JSC::JSModuleNamespaceObject::destroy):

runtime/JSModuleNamespaceObject.h:

(JSC::JSModuleNamespaceObject::create):
(JSC::JSModuleNamespaceObject::moduleRecord):

runtime/JSObject.cpp:

(JSC::JSObject::freeze):
(JSC::JSObject::preventExtensions):
(JSC::JSObject::reifyAllStaticProperties):

runtime/JSObject.h:

(JSC::JSObject::isSealed):
(JSC::JSObject::isFrozen):
(JSC::JSObject::isExtensible):

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorSeal):
(JSC::objectConstructorFreeze):
(JSC::objectConstructorPreventExtensions):
(JSC::objectConstructorIsSealed):

runtime/ReflectObject.cpp:

(JSC::reflectObjectPreventExtensions):

runtime/Structure.cpp:

(JSC::Structure::Structure):
(JSC::Structure::preventExtensionsTransition):

runtime/Structure.h:

Feb 29, 2016:

11:39 PM Changeset in webkit [197390] by zandobersek@gmail.com

2 edits in trunk/Source/WebKit2

ThreadedCompositor: clean up composition-specific resources before shutting down the thread
https://bugs.webkit.org/show_bug.cgi?id=154793

Reviewed by Carlos Garcia Campos.

Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:

(WebKit::ThreadedCompositor::runCompositingThread): Before concluding the
compositing thread run, clean up all the resources that were allocated at
the start, and in the reverse order. Specifically, we now also deallocate
the CoordinatedGraphicsScene and the SimpleViewportController objects. This
way these are not deallocated on the main thread when the ThreadedCompositor
destructor would otherwise clean them up.

11:37 PM Changeset in webkit [197389] by Chris Dumez

13 edits in trunk

Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use WTF::Optional
https://bugs.webkit.org/show_bug.cgi?id=154845

Reviewed by Ryosuke Niwa.

Source/WebCore:

Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use
WTF::Optional.

dom/Element.cpp:

(WebCore::Element::getIntegralAttribute):
(WebCore::Element::getUnsignedIntegralAttribute):
(WebCore::Element::setUnsignedIntegralAttribute): Deleted.

html/HTMLElement.cpp:

(WebCore::HTMLElement::parseBorderWidthAttribute):
(WebCore::HTMLElement::parseAttribute):

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::parseMaxLengthAttribute):

html/HTMLInputElement.h:
html/HTMLOListElement.cpp:

(WebCore::HTMLOListElement::parseAttribute):

html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::maxLength):

html/ImageInputType.cpp:

(WebCore::ImageInputType::height):
(WebCore::ImageInputType::width):

html/parser/HTMLParserIdioms.cpp:

(WebCore::parseHTMLIntegerInternal):
(WebCore::parseHTMLInteger):
(WebCore::parseHTMLNonNegativeInteger):

html/parser/HTMLParserIdioms.h:

(WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
(WebCore::limitToOnlyHTMLNonNegative):

svg/SVGElement.cpp:

(WebCore::SVGElement::parseAttribute):

Tools:

Update API tests accordingly.

TestWebKitAPI/Tests/WebCore/HTMLParserIdioms.cpp:

(TestWebKitAPI::testParseHTMLInteger):
(TestWebKitAPI::parseHTMLIntegerFails):
(TestWebKitAPI::testParseHTMLNonNegativeInteger):
(TestWebKitAPI::parseHTMLNonNegativeIntegerFails):
(TestWebKitAPI::TEST): Deleted.

11:36 PM Changeset in webkit [197388] by zandobersek@gmail.com

3 edits in trunk/Source/WebKit2

ThreadSafeCoordinatedSurface: remove the unused private create() static method
https://bugs.webkit.org/show_bug.cgi?id=154792

Reviewed by Carlos Garcia Campos.

Remove the static ThreadSafeCoordinatedSurface::create() method that accepted
a std::unique_ptr<ImageBuffer> object as its third parameter. This was not used
anywhere.

Shared/CoordinatedGraphics/threadedcompositor/ThreadSafeCoordinatedSurface.cpp:

(WebKit::ThreadSafeCoordinatedSurface::create): Deleted.

Shared/CoordinatedGraphics/threadedcompositor/ThreadSafeCoordinatedSurface.h:

11:32 PM Changeset in webkit [197387] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

TextureMapperGL: simplify TransformationMatrix copies in draw(), beginClip()
https://bugs.webkit.org/show_bug.cgi?id=154791

Reviewed by Carlos Garcia Campos.

In both functions, the passed-in model-view matrix is first copied, multiplied
against a rect-to-rect TransformationMatrix, and then assigned into a local
TransformationMatrix variable, which causes another copy due to the multiply()
function returning a reference to the modified object.

To avoid the last copy, first copy the model-view matrix into a local variable,
and multiply the rect-to-rect TransformationMatrix into the new object afterwards.

platform/graphics/texmap/TextureMapperGL.cpp:

(WebCore::TextureMapperGL::draw):
(WebCore::TextureMapperGL::beginClip):

11:31 PM Changeset in webkit [197386] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

ImageBufferCairo should support OpenGL ES 2 configurations
https://bugs.webkit.org/show_bug.cgi?id=154790

Reviewed by Carlos Garcia Campos.

When building with OpenGL ES 2 and with accelerated 2D canvas support,
the GLES2 header should be included instead of the OpenGLShims.h header.

The glTexParameterf() calls targeting GL_TEXTURE_WRAP_S and
GL_TEXTURE_WRAP_T parameters should use the GL_CLAMP_TO_EDGE value.
GL_CLAMP isn't available in OpenGL ES 2 and was dropped in OpenGL 3.

platform/graphics/cairo/ImageBufferCairo.cpp:

(WebCore::ImageBufferData::createCairoGLSurface):

11:30 PM Changeset in webkit [197385] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

TextureMapperGL: beginPainting() should handle the PaintingMirrored value in PaintFlags
https://bugs.webkit.org/show_bug.cgi?id=154789

Reviewed by Carlos Garcia Campos.

platform/graphics/texmap/TextureMapperGL.cpp:

(WebCore::TextureMapperGL::beginPainting): The ClipStack should be reset with
a Y-axis mode that corresponds to the presence of the PaintingMirrored value in
the passed-in PaintFlags argument. If present, the default Y-axis mode should be
used, and the inverted Y-axis otherwise.

11:28 PM Changeset in webkit [197384] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

CoordinatedGraphicsLayer should override the inherited TextureMapperPlatformLayer::Client methods
https://bugs.webkit.org/show_bug.cgi?id=154788

Reviewed by Carlos Garcia Campos.

platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:

Add the override specifiers for the two methods that are inherited
from the TextureMapperPlatformLayer::Client interface.

7:48 PM Changeset in webkit [197383] by Yusuke Suzuki

3 edits
1 add in trunk/Source/JavaScriptCore

[JSC] Private symbols should not be trapped by proxy handler
https://bugs.webkit.org/show_bug.cgi?id=154817

Reviewed by Mark Lam.

Since the runtime has some assumptions on the properties associated with the private symbols, ES6 Proxy should not trap these property operations.
For example, in ArrayIteratorPrototype.js

var itemKind = this.@arrayIterationKind;
if (itemKind === @undefined)

throw new @TypeError("%ArrayIteratorPrototype%.next requires that |this| be an Array Iterator instance");

Here, we assume that only the array iterator has the @arrayIterationKind property that value is non-undefined.
But If we implement Proxy with the get handler, that returns a non-undefined value for every operations, we accidentally assumes that the given value is an array iterator.

To avoid these situation, we perform the default operations onto property operations with private symbols.

runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::performPut):
(JSC::ProxyObject::performDelete):
(JSC::ProxyObject::deleteProperty):
(JSC::ProxyObject::deletePropertyByIndex):

tests/stress/proxy-basic.js:
tests/stress/proxy-with-private-symbols.js: Added.

(assert):
(let.handler.getOwnPropertyDescriptor):

7:42 PM Changeset in webkit [197382] by Simon Fraser

25 edits in trunk

Remove the experimental feature of antialiased font dilation
https://bugs.webkit.org/show_bug.cgi?id=154843

Reviewed by Zalan Bujtas.
Source/WebCore:

Remove the "antialiased font dilation" code path, and related prefs.

page/Settings.cpp:

(WebCore::Settings::Settings): Deleted.
(WebCore::Settings::setAntialiasedFontDilationEnabled): Deleted.

page/Settings.h:

(WebCore::Settings::antialiasedFontDilationEnabled): Deleted.

platform/graphics/FontCascade.cpp:

(WebCore::FontCascade::setAntialiasedFontDilationEnabled): Deleted.
(WebCore::FontCascade::antialiasedFontDilationEnabled): Deleted.

platform/graphics/FontCascade.h:
platform/graphics/GraphicsContext.cpp:

(WebCore::GraphicsContextStateChange::changesFromState): Deleted.
(WebCore::GraphicsContextStateChange::accumulate): Deleted.
(WebCore::GraphicsContextStateChange::apply): Deleted.
(WebCore::GraphicsContextStateChange::dump): Deleted.
(WebCore::GraphicsContext::setAntialiasedFontDilationEnabled): Deleted.

platform/graphics/GraphicsContext.h:

(WebCore::GraphicsContextState::GraphicsContextState): Deleted.
(WebCore::GraphicsContext::antialiasedFontDilationEnabled): Deleted.

platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:

(PlatformCALayer::drawLayerContents): Deleted.

platform/graphics/cocoa/FontCascadeCocoa.mm:

(WebCore::dilationSizeForTextColor): Deleted.
(WebCore::FontCascade::drawGlyphs): Deleted.

platform/graphics/displaylists/DisplayList.cpp:

(WebCore::DisplayList::DisplayList::shouldDumpForFlags): Deleted.

Source/WebKit/mac:

Remove the "antialiased font dilation" code path, and related prefs.

WebView/WebPreferenceKeysPrivate.h:
WebView/WebPreferences.mm:

(+[WebPreferences initialize]): Deleted.
(-[WebPreferences setAntialiasedFontDilationEnabled:]): Deleted.
(-[WebPreferences antialiasedFontDilationEnabled]): Deleted.

WebView/WebPreferencesPrivate.h:
WebView/WebView.mm:

(-[WebView _preferencesChanged:]): Deleted.

Source/WebKit2:

Remove the "antialiased font dilation" code path, and related prefs.

Shared/WebPreferencesDefinitions.h:
UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetAntialiasedFontDilationEnabled):
(WKPreferencesGetAntialiasedFontDilationEnabled):

UIProcess/API/C/WKPreferencesRefPrivate.h:
UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences _antialiasedFontDilationEnabled]): Deleted.
(-[WKPreferences _setAntialiasedFontDilationEnabled:]): Deleted.

UIProcess/API/Cocoa/WKPreferencesPrivate.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences): Deleted.

Tools:

Remove the "antialiased font dilation" code path, and related prefs.

DumpRenderTree/mac/DumpRenderTree.mm:

(resetWebPreferencesToConsistentValues): Deleted.

WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues): Deleted.

7:18 PM Changeset in webkit [197381] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

regress/script-tests/double-pollution-putbyoffset.js.ftl-eager timed out because of a lock ordering deadlock involving InferredType and CodeBlock
https://bugs.webkit.org/show_bug.cgi?id=154841

Reviewed by Benjamin Poulain.

Here's the deadlock:

Main thread:

1) Change an InferredType. This acquires InferredType::m_lock.
2) Fire watchpoint set. This triggers CodeBlock invalidation, which acquires

CodeBlock::m_lock.

DFG thread:

1) Iterate over the information in a CodeBlock. This acquires CodeBlock::m_lock.
2) Ask an InferredType for its descriptor(). This acquires InferredType::m_lock.

I think that the DFG thread's ordering should be legal, because the best logic for lock
hierarchies is that locks that protect the largest set of stuff should be acquired first.

This means that the main thread shouldn't be holding the InferredType::m_lock when firing
watchpoint sets. That's what this patch ensures.

At the time of writing, this test was deadlocking for me on trunk 100% of the time. With
this change I cannot get it to deadlock.

runtime/InferredType.cpp:

(JSC::InferredType::willStoreValueSlow):
(JSC::InferredType::makeTopSlow):
(JSC::InferredType::set):
(JSC::InferredType::removeStructure):
(JSC::InferredType::InferredStructureWatchpoint::fireInternal):

runtime/InferredType.h:

6:30 PM Changeset in webkit [197380] by Yusuke Suzuki

46 edits
8 adds in trunk

[DFG][FTL][B3] Support floor and ceil
https://bugs.webkit.org/show_bug.cgi?id=154683

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch implements and fixes the following things.

Implement Ceil and Floor in DFG, FTL and B3

x86 SSE 4.2 and ARM64 have round instructions that can directly perform Ceil or Floor.
This patch leverages this functionality. We introduce ArithFloor and ArithCeil.
During DFG phase, these nodes attempt to convert itself to Identity (in Fixup phase).
As the same to ArithRound, it tracks arith rounding mode.
And if these nodes are required to emit machine codes, we emit rounding machine code
if it is supported in the current machine. For example, in x86, we emit round.

This Floor functionality is nice for @toInteger in builtin.
That is used for Array.prototype.{forEach, map, every, some, reduce...}
And according to the benchmark results, Kraken audio-oscillator is slightly improved
due to its frequent Math.round and Math.floor calls.

Implement Floor in B3 and Air

As the same to Ceil in B3, we add a new B3 IR and Air opcode, Floor.
This Floor is leveraged to implement ArithFloor in DFG.

Fix ArithRound operation

Currently, we used cvtsd2si (in x86) to convert double value to int32.
And we also used this to implement Math.round, like, cvtsd2si(value + 0.5).
However, this implementation is not correct. Because cvtsd2si is not floor operation.
It is trucate operation. This is OK for positive numbers. But NG for negative numbers.
For example, the current implementation accidentally rounds -0.6 to -0.0. This should be -1.0.
Using Ceil and Floor instructions, we implement correct ArithRound.

assembler/MacroAssemblerARM.h:

(JSC::MacroAssemblerARM::supportsFloatingPointRounding):
(JSC::MacroAssemblerARM::ceilDouble):
(JSC::MacroAssemblerARM::floorDouble):
(JSC::MacroAssemblerARM::supportsFloatingPointCeil): Deleted.

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::supportsFloatingPointRounding):
(JSC::MacroAssemblerARM64::floorFloat):
(JSC::MacroAssemblerARM64::supportsFloatingPointCeil): Deleted.

assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::supportsFloatingPointRounding):
(JSC::MacroAssemblerARMv7::ceilDouble):
(JSC::MacroAssemblerARMv7::floorDouble):
(JSC::MacroAssemblerARMv7::supportsFloatingPointCeil): Deleted.

assembler/MacroAssemblerMIPS.h:

(JSC::MacroAssemblerMIPS::ceilDouble):
(JSC::MacroAssemblerMIPS::floorDouble):
(JSC::MacroAssemblerMIPS::supportsFloatingPointRounding):
(JSC::MacroAssemblerMIPS::supportsFloatingPointCeil): Deleted.

assembler/MacroAssemblerSH4.h:

(JSC::MacroAssemblerSH4::supportsFloatingPointRounding):
(JSC::MacroAssemblerSH4::ceilDouble):
(JSC::MacroAssemblerSH4::floorDouble):
(JSC::MacroAssemblerSH4::supportsFloatingPointCeil): Deleted.

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::floorDouble):
(JSC::MacroAssemblerX86Common::floorFloat):
(JSC::MacroAssemblerX86Common::supportsFloatingPointRounding):
(JSC::MacroAssemblerX86Common::supportsFloatingPointCeil): Deleted.

b3/B3ConstDoubleValue.cpp:

(JSC::B3::ConstDoubleValue::floorConstant):

b3/B3ConstDoubleValue.h:
b3/B3ConstFloatValue.cpp:

(JSC::B3::ConstFloatValue::floorConstant):

b3/B3ConstFloatValue.h:
b3/B3LowerMacrosAfterOptimizations.cpp:
b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::lower):

b3/B3Opcode.cpp:

(WTF::printInternal):

b3/B3Opcode.h:
b3/B3ReduceDoubleToFloat.cpp:
b3/B3ReduceStrength.cpp:
b3/B3Validate.cpp:
b3/B3Value.cpp:

(JSC::B3::Value::floorConstant):
(JSC::B3::Value::isRounded):
(JSC::B3::Value::effects):
(JSC::B3::Value::key):
(JSC::B3::Value::typeFor):

b3/B3Value.h:
b3/air/AirFixPartialRegisterStalls.cpp:
b3/air/AirOpcode.opcodes:
b3/testb3.cpp:

(JSC::B3::testFloorCeilArg):
(JSC::B3::testFloorArg):
(JSC::B3::testFloorImm):
(JSC::B3::testFloorMem):
(JSC::B3::testFloorFloorArg):
(JSC::B3::testCeilFloorArg):
(JSC::B3::testFloorIToD64):
(JSC::B3::testFloorIToD32):
(JSC::B3::testFloorArgWithUselessDoubleConversion):
(JSC::B3::testFloorArgWithEffectfulDoubleConversion):
(JSC::B3::run):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGArithMode.cpp:

(WTF::printInternal):

dfg/DFGArithMode.h:
dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

dfg/DFGGraph.h:

(JSC::DFG::Graph::roundShouldSpeculateInt32):

dfg/DFGNode.h:

(JSC::DFG::Node::arithNodeFlags):
(JSC::DFG::Node::hasHeapPrediction):
(JSC::DFG::Node::hasArithRoundingMode):

dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithRounding):
(JSC::DFG::SpeculativeJIT::compileArithRound): Deleted.

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
(JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
(JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):

ftl/FTLOutput.h:

(JSC::FTL::Output::doubleFloor):

jit/ThunkGenerators.cpp:

(JSC::ceilThunkGenerator):

tests/stress/math-ceil-arith-rounding-mode.js: Added.

(firstCareAboutZeroSecondDoesNot):
(firstDoNotCareAboutZeroSecondDoes):
(warmup):
(verifyNegativeZeroIsPreserved):

tests/stress/math-ceil-basics.js: Added.

(mathCeilOnIntegers):
(mathCeilOnDoubles):
(mathCeilOnBooleans):
(uselessMathCeil):
(mathCeilWithOverflow):
(mathCeilConsumedAsDouble):
(mathCeilDoesNotCareAboutMinusZero):
(mathCeilNoArguments):
(mathCeilTooManyArguments):
(testMathCeilOnConstants):
(mathCeilStructTransition):
(Math.ceil):

tests/stress/math-floor-arith-rounding-mode.js: Added.

(firstCareAboutZeroSecondDoesNot):
(firstDoNotCareAboutZeroSecondDoes):
(warmup):
(verifyNegativeZeroIsPreserved):

tests/stress/math-floor-basics.js: Added.

(mathFloorOnIntegers):
(mathFloorOnDoubles):
(mathFloorOnBooleans):
(uselessMathFloor):
(mathFloorWithOverflow):
(mathFloorConsumedAsDouble):
(mathFloorDoesNotCareAboutMinusZero):
(mathFloorNoArguments):
(mathFloorTooManyArguments):
(testMathFloorOnConstants):
(mathFloorStructTransition):
(Math.floor):

tests/stress/math-round-should-not-use-truncate.js: Added.

(mathRoundDoesNotCareAboutMinusZero):

tests/stress/math-rounding-infinity.js: Added.

(shouldBe):
(testRound):
(testFloor):
(testCeil):

tests/stress/math-rounding-nan.js: Added.

(shouldBe):
(testRound):
(testFloor):
(testCeil):

tests/stress/math-rounding-negative-zero.js: Added.

(shouldBe):
(testRound):
(testFloor):
(testCeil):
(testRoundNonNegativeZero):
(testRoundNonNegativeZero2):

Websites/webkit.org:

docs/b3/intermediate-representation.html:

6:07 PM Changeset in webkit [197379] by commit-queue@webkit.org

29 edits in trunk/Source/JavaScriptCore

Add new MethodTable method to get an estimated size for a cell
https://bugs.webkit.org/show_bug.cgi?id=154838

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-29
Reviewed by Filip Pizlo.

The new class method estimatedSize(JSCell*) estimates the size for a single cell.
As the name implies, this is meant to be an approximation. It is more important
that big objects report a large size, then to get perfect size information for
all objects in the heap.

Base implementation (JSCell):

returns the MarkedBlock bucket size for this cell.
This gets us the object size include inline storage. Basically a better sizeof.

Subclasses with "Extra Memory Cost":

Any class that reports extra memory (reportExtraMemoryVisited) should include that in the estimated size.
E.g. CodeBlock, JSGenericTypedArrayView, WeakMapData, etc.

Subclasses with "Copied Space" storage:

Any class with data in copied space (copyBackingStore) should include that in the estimated size.
E.g. JSObject, JSGenericTypedArrayView, JSMap, JSSet, DirectArguments, etc.

Add reportExtraMemoryVisited for UnlinkedCodeBlock's compressed unlinked
instructions because this can be larger than 1kb, which is significant.

This has one special case for RegExp generated bytecode / JIT code, which
does not currently fall into the extra memory cost or copied space storage.
In practice I haven't seen this grow to a significant cost.

runtime/ClassInfo.h:

Add the new estimatedSize method to the table.

bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::visitChildren):
(JSC::UnlinkedCodeBlock::estimatedSize):
(JSC::UnlinkedCodeBlock::setInstructions):

bytecode/UnlinkedCodeBlock.h:

Report an extra memory cost for unlinked code blocks like
we do for linked code blocks.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::estimatedSize):

bytecode/CodeBlock.h:
bytecode/UnlinkedInstructionStream.cpp:

(JSC::UnlinkedInstructionStream::sizeInBytes):

bytecode/UnlinkedInstructionStream.h:
runtime/DirectArguments.cpp:

(JSC::DirectArguments::estimatedSize):

runtime/DirectArguments.h:
runtime/JSCell.cpp:

(JSC::JSCell::estimatedSizeInBytes):
(JSC::JSCell::estimatedSize):

runtime/JSCell.h:
runtime/JSGenericTypedArrayView.h:
runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):

runtime/JSMap.cpp:

(JSC::JSMap::estimatedSize):

runtime/JSMap.h:
runtime/JSObject.cpp:

(JSC::JSObject::visitButterfly):

runtime/JSObject.h:
runtime/JSSet.cpp:

(JSC::JSSet::estimatedSize):

runtime/JSSet.h:
runtime/JSString.cpp:

(JSC::JSString::estimatedSize):

runtime/JSString.h:
runtime/MapData.h:

(JSC::MapDataImpl::capacityInBytes):

runtime/WeakMapData.cpp:

(JSC::WeakMapData::estimatedSize):
(JSC::WeakMapData::visitChildren):

runtime/WeakMapData.h:

Implement estimated size following the pattern of reporting
extra visited size, or copy space memory.

runtime/RegExp.cpp:

(JSC::RegExp::estimatedSize):

runtime/RegExp.h:
yarr/YarrInterpreter.h:

(JSC::Yarr::ByteDisjunction::estimatedSizeInBytes):
(JSC::Yarr::BytecodePattern::estimatedSizeInBytes):

yarr/YarrJIT.h:

(JSC::Yarr::YarrCodeBlock::size):
Include generated bytecode / JITCode to a RegExp's size.

5:36 PM Changeset in webkit [197378] by Ryan Haddad

3 edits in trunk/LayoutTests

Marking webgl/1.0.2/conformance/extensions/get-extension.html as flaky on mac, removing wk1 specific flakiness expectation.
https://bugs.webkit.org/show_bug.cgi?id=152506

Unreviewed test gardening.

platform/mac-wk1/TestExpectations:
platform/mac/TestExpectations:

5:16 PM Changeset in webkit [197377] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange.html as flaky on mac
https://bugs.webkit.org/show_bug.cgi?id=154748

Unreviewed test gardening.

platform/mac/TestExpectations:

4:54 PM Changeset in webkit [197376] by Ryan Haddad

2 edits in trunk/LayoutTests

Re-enable passing fast/multicol/newmulticol tests on ios-simulator

Unreviewed test gardening.

platform/ios-simulator-wk2/TestExpectations:

4:44 PM Changeset in webkit [197375] by jer.noble@apple.com

7 edits
9 adds in trunk/Source/WebCore

Refactor CoreVideo API access into their own classes so code can be re-used.
https://bugs.webkit.org/show_bug.cgi?id=154544

Reviewed by Eric Carlson.

In order for common CoreVideo code paths to be re-used in other classes, pull those paths
out of MediaPlayerPrivateAVFoundationObjC and into re-usable clasess.

WebCore.xcodeproj/project.pbxproj:
platform/cf/CoreMediaSoftLink.cpp:
platform/cf/CoreMediaSoftLink.h:
platform/cocoa/CoreVideoSoftLink.cpp: Added.
platform/cocoa/CoreVideoSoftLink.h: Added.
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastImage):
(WebCore::MediaPlayerPrivateAVFoundationObjC::copyVideoTextureToPlatformTexture):
(WebCore::CVPixelBufferGetBytePointerCallback): Deleted.
(WebCore::CVPixelBufferReleaseBytePointerCallback): Deleted.
(WebCore::CVPixelBufferReleaseInfoCallback): Deleted.
(WebCore::createImageFromPixelBuffer): Deleted.
(WebCore::enumToStringMap): Deleted.

platform/graphics/cv/PixelBufferConformerCV.cpp: Added.

(WebCore::PixelBufferConformerCV::PixelBufferConformerCV):
(WebCore::CVPixelBufferGetBytePointerCallback):
(WebCore::CVPixelBufferReleaseBytePointerCallback):
(WebCore::CVPixelBufferReleaseInfoCallback):
(WebCore::PixelBufferConformerCV::createImageFromPixelBuffer):

platform/graphics/cv/PixelBufferConformerCV.h: Added.
platform/graphics/cv/TextureCacheCV.h: Added.

(WebCore::TextureCacheCV::context):

platform/graphics/cv/TextureCacheCV.mm: Added.

(WebCore::TextureCacheCV::create):
(WebCore::TextureCacheCV::TextureCacheCV):
(WebCore::TextureCacheCV::textureFromImage):

platform/graphics/cv/VideoTextureCopierCV.cpp: Added.

(WebCore::VideoTextureCopierCV::VideoTextureCopierCV):
(WebCore::VideoTextureCopierCV::~VideoTextureCopierCV):
(WebCore::enumToStringMap):
(WebCore::VideoTextureCopierCV::copyVideoTextureToPlatformTexture):

platform/graphics/cv/VideoTextureCopierCV.h: Added.

(WebCore::VideoTextureCopierCV::context):

platform/mediastream/mac/AVVideoCaptureSource.mm: Move SOFT_LINK declarations into CoreVideoSoftLink.h/cpp.

4:39 PM Changeset in webkit [197374] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

SpeculatedType should be easier to edit
https://bugs.webkit.org/show_bug.cgi?id=154840

Reviewed by Mark Lam.

We used to specify the bitmasks in SpeculatedType.h using hex codes. This used to work
great because we didn't have so many masks and you could use the mask to visually see
which ones overlapped. It also made it easy to visualize subset relationships.

But now we have a lot of masks with a lot of confusing overlaps, and it's no longer
possible to just see their relationship by looking at hex codes. Worse, the use of hex
codes makes it super annoying to move the bits around. For example, right now we have two
bits free, but if we wanted to reclaim them by editing the old hex masks, it would be a
nightmare.

So this patch replaces the hex masks with shift expressions (1u << 15 for example) and it
makes any derived masks (i.e. masks that are the bit-or of other masks) be expressed using
an or expression (SpecFoo | SpecBar | SpecBaz for example).

This makes it easier to see the relationships and it makes it easier to take bits for new
types.

bytecode/SpeculatedType.h:

4:08 PM Changeset in webkit [197373] by beidson@apple.com

4 edits in trunk/Tools

Fix timing flakiness in test I added in http://trac.webkit.org/changeset/197372

Unreviewed.

TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-1.html:
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-2.html:
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess.mm:

(TEST): Sometimes a third message from the first html file was leaking through. The message is expected

so we should always wait for it and make sure we got it.

3:13 PM Changeset in webkit [197372] by beidson@apple.com

9 edits
3 adds in trunk

Modern IDB: WebKit 2 IPC layer easily confused about multiple web processes being connected.
https://bugs.webkit.org/show_bug.cgi?id=154837

Reviewed by Alex Christensen.

Source/WebKit2:

The crux of the bug is that WebProcesses cannot assign themselves server-unique identifiers...
The server must do that for them.

A once-per-session-per-WebProcess sync message and a few updates to connection management fix this.

DatabaseProcess/DatabaseToWebProcessConnection.cpp:

(WebKit::DatabaseToWebProcessConnection::didReceiveSyncMessage):
(WebKit::generateConnectionToServerIdentifier):
(WebKit::DatabaseToWebProcessConnection::establishIDBConnectionToServer):

DatabaseProcess/DatabaseToWebProcessConnection.h:
DatabaseProcess/DatabaseToWebProcessConnection.messages.in:

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::WebIDBConnectionToServer):
(WebKit::generateConnectionToServerIdentifier): Deleted.

WebProcess/Databases/WebToDatabaseProcessConnection.cpp:

(WebKit::WebToDatabaseProcessConnection::didReceiveMessage):
(WebKit::WebToDatabaseProcessConnection::idbConnectionToServerForSession):

WebProcess/Databases/WebToDatabaseProcessConnection.h:

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-1.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-2.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess.mm: Added.

3:06 PM Changeset in webkit [197371] by commit-queue@webkit.org

8 edits in trunk/Source/WebInspectorUI

Web Inspector: Add direct number inputs to Bezier editor
https://bugs.webkit.org/show_bug.cgi?id=154809
<rdar://problem/24881465>

Patch by Devin Rousso <Devin Rousso> on 2016-02-29
Reviewed by Timothy Hatcher.

UserInterface/Base/Main.js:

(WebInspector._updateWindowKeydownListener):
Now only adds the shared event listener when the first keydown listener
is added via WebInspector.addWindowKeydownListener

UserInterface/Controllers/CodeMirrorBezierEditingController.js:

(WebInspector.CodeMirrorBezierEditingController.prototype.popoverDidDismiss):

UserInterface/Controllers/CodeMirrorEditingController.js:

(WebInspector.CodeMirrorEditingController.prototype.popoverDidDismiss):
(WebInspector.CodeMirrorEditingController.prototype.didDismissPopover):
Added function that is called when the popover is dismissed so that
removing event listeners is possible.

UserInterface/Views/BezierEditor.css:

(.bezier-editor):
(.bezier-editor > .number-input-container):
(.bezier-editor > .number-input-container > input):

UserInterface/Views/BezierEditor.js:

(WebInspector.BezierEditor.createControl):
(WebInspector.BezierEditor.createBezierInput):
(WebInspector.BezierEditor):
Added usage of Element.prototype.createChild for ease of readability.
Also added input elements for manually changing the values of each bezier
point's x and y values.

(WebInspector.BezierEditor.prototype.set bezier):
(WebInspector.BezierEditor.prototype.removeListeners):
(WebInspector.BezierEditor.prototype._handleMousedown):
(WebInspector.BezierEditor.prototype._updateBezier):
(WebInspector.BezierEditor.prototype._updateBezierPreview):
(WebInspector.BezierEditor.prototype._triggerPreviewAnimation):
(WebInspector.BezierEditor.prototype._handleNumberInputInput):
(WebInspector.BezierEditor.prototype._handleNumberInputKeydown):
(WebInspector.BezierEditor.prototype._changeBezierForInput):
Refactored code to make it more reusable, as well as adding event listeners
to the newly created inputs, including value chaning from the arrow keys.

UserInterface/Views/CSSStyleDeclarationTextEditor.js:

(WebInspector.CSSStyleDeclarationTextEditor.prototype.didDismissPopover): Deleted.
Removed unused code.

UserInterface/Views/InlineSwatch.js:

(WebInspector.InlineSwatch):
(WebInspector.InlineSwatch.prototype.didDismissPopover):
Removes any global event listeners added by the current editor if able.

(WebInspector.InlineSwatch.prototype._swatchElementClicked):
Now saves the current editor object as a member variable.

2:45 PM Changeset in webkit [197370] by keith_miller@apple.com

3 edits in trunk/Source/JavaScriptCore

OverridesHasInstance constant folding is wrong
https://bugs.webkit.org/show_bug.cgi?id=154833

Reviewed by Filip Pizlo.

The current implementation of OverridesHasInstance constant folding
is incorrect. Since it relies on OSR exit information it has been
moved to the StrengthReductionPhase. Normally, such an optimazation would be
put in FixupPhase, however, there are a number of cases where we don't
determine an edge of OverridesHasInstance is a constant until after fixup.
Performing the optimization during StrengthReductionPhase means we can defer
our decision until later.

In the future we should consider creating a version of this optimization
that does not depend on OSR exit information and move the optimization back
to ConstantFoldingPhase.

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.

dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

2:41 PM Changeset in webkit [197369] by Ryan Haddad

1 edit
1 delete in trunk/LayoutTests

Removing unnecessary ios-simulator-wk2 expectation file.

Unreviewed test gardening.

platform/ios-simulator-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt: Removed.

2:37 PM Changeset in webkit [197368] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-forms.html after r197355

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:

2:37 PM Changeset in webkit [197367] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-embedded.html for ios-simulator after r197237

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt:

2:33 PM Changeset in webkit [197366] by fpizlo@apple.com

5 edits
6 adds in trunk

B3 should have global store elimination
https://bugs.webkit.org/show_bug.cgi?id=154658

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

Implements fairly comprehensive global store elimination:

1) If you store the result of a load with no interference in between, remove the store.

2) If you store the same thing you stored previously, remove the store.

3) If you store something that you either loaded previously or stored previously along

arbitrarily many paths, remove the store.

4) If you store to something that is stored to again in the future with no interference in

between, remove the store.

Rule (4) is super relevant to FTL since the DFG does not eliminate redundant PutStructures.
A constructor that produces a large object will have many redundant stores to the same base
pointer, offset, and heap range, with no code to observe that heap raneg in between.

This doesn't have a decisive effect on major benchmarks, but it's an enormous win for
microbenchmarks:

30% faster to construct an object with many fields.

5x faster to do many stores to a global variable.

The compile time cost should be very small. Although the optimization is global, it aborts as
soon as it sees anything that would confound store elimination. For rules (1)-(3), we
piggy-back the existing load elimination, which gives up on interfering stores. For rule (4),
we search forward through the current block and then globally a block at a time (skipping
block contents thanks to summary data), which could be expensive. But rule (4) aborts as soon
as it sees a read, write, or end block (Return or Oops). Any Check will claim to read TOP. Any
Patchpoint that results from an InvalidationPoint will claim to read TOP, as will any
Patchpoints for ICs. Those are usually sprinkled all over the program.

In other words, this optimization rarely kicks in. When it does kick in, it makes programs run
faster. When it doesn't kick in, it's usually O(1) because there are reasons for aborting all
over a "normal" program so the search will halt almost immediately. This of course raises the
question: how much more in compile time do we pay when the optimization does kick in? The
optimization kicks in the most for the microbenchmarks I wrote for this patch. Amazingly, the
effect of the optimization a wash for compile time: whatever cost we pay doing the O(n^{2)

searches is balanced by the massive reduction in work in the backend. On one of the two

microbenchmarks, overall compile time actually shrank with this optimization even though CSE

itself cost more. That's not too surprising - the backend costs much more per instruction, so

things that remove instructions before we get to the backend tend to be a good idea.}

We could consider adding a more aggressive version of this in the future, which could sink
stores into checks. That could be crazy fun: https://bugs.webkit.org/show_bug.cgi?id=152162#c3

But mainly, I'm adding this optimization because it was super fun to implement during the
WebAssembly CG summit.

b3/B3EliminateCommonSubexpressions.cpp:
b3/B3MemoryValue.h:
b3/B3SuccessorCollection.h:

(JSC::B3::SuccessorCollection::begin):
(JSC::B3::SuccessorCollection::end):
(JSC::B3::SuccessorCollection::const_iterator::const_iterator):
(JSC::B3::SuccessorCollection::const_iterator::operator*):
(JSC::B3::SuccessorCollection::const_iterator::operator++):
(JSC::B3::SuccessorCollection::const_iterator::operator==):
(JSC::B3::SuccessorCollection::const_iterator::operator!=):

LayoutTests:

These two benchmarks both speed up significantly with this change.

js/regress/build-large-object-expected.txt: Added.
js/regress/build-large-object.html: Added.
js/regress/many-repeat-stores-expected.txt: Added.
js/regress/many-repeat-stores.html: Added.
js/regress/script-tests/build-large-object.js: Added.
js/regress/script-tests/many-repeat-stores.js: Added.

2:14 PM Changeset in webkit [197365] by fpizlo@apple.com

9 edits
1 add in trunk/Source/JavaScriptCore

Make it cheap to #include "JITOperations.h"
https://bugs.webkit.org/show_bug.cgi?id=154836

Reviewed by Mark Lam.

Prior to this change, this header included the whole world even though it did't have any
definitions. This patch turns almost all of the includes into forward declarations. Right
now this header is very cheap to include.

JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
JavaScriptCore.xcodeproj/project.pbxproj:
dfg/DFGSpeculativeJIT.h:
jit/JITOperations.cpp:
jit/JITOperations.h:
jit/Repatch.h:
runtime/CommonSlowPaths.h:

(JSC::encodeResult): Deleted.
(JSC::decodeResult): Deleted.

runtime/SlowPathReturnType.h: Added.

(JSC::encodeResult):
(JSC::decodeResult):

1:32 PM Changeset in webkit [197364] by Chris Dumez

3 edits in trunk/Source/WebCore

Use WTF::Optional for HTMLOListElement::m_start
https://bugs.webkit.org/show_bug.cgi?id=154824

Reviewed by Andreas Kling.

Use WTF::Optional for HTMLOListElement::m_start.

html/HTMLOListElement.cpp:

(WebCore::HTMLOListElement::parseAttribute):

html/HTMLOListElement.h:

1:14 PM Changeset in webkit [197363] by jdiggs@igalia.com

2 edits
1 add in trunk/Tools

[GTK][jhbuild] GLib build fails with GCC 6.0
https://bugs.webkit.org/show_bug.cgi?id=154825

Use the upstream work-around. https://bugzilla.gnome.org/show_bug.cgi?id=761550

Reviewed by Csaba Osztrogonác.

gtk/jhbuild.modules: Apply upstream path.
gtk/patches/gdate-suppress-string-format-literal-warning.patch: Added.

12:46 PM Changeset in webkit [197362] by achristensen@apple.com

5 edits in trunk/Source/WebKit2

Don't call NetworkProcess::singleton from WebProcess when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154829

Reviewed by Anders Carlsson.

We were calling NetworkProcess::singleton when making the default session in the
WebProcess, which caused bad things to happen. We also were never clearing the
credentials in the WebProcess between tests because it used to always call
NetworkProcess::singleton, which caused flaky tests.

This fixes repeatable crashes in http/tests/media/media-document-referer.html and
http/tests/media/media-document.html when using NetworkSession.

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::NetworkProcess):
(WebKit::NetworkProcess::~NetworkProcess):

NetworkProcess/NetworkSession.h:
NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::configurationForType):
(WebKit::globalCustomProtocolManager):
(WebKit::NetworkSession::setCustomProtocolManager):
(WebKit::NetworkSession::defaultSession):

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::clearCachedCredentials):

11:35 AM Changeset in webkit [197361] by fpizlo@apple.com

2 edits in trunk/Tools

We've been running Octane/regexp all wrong in run-jsc-benchmarks
https://bugs.webkit.org/show_bug.cgi?id=154827

Reviewed by Andreas Kling.

Octane v.2 and JetStream v.1.1 run this benchmark with warmup. This script was running
it without warmup. This patches fixes this by making this script run it with warmup.

This fix shows that my last patch, which added FTL support for regexp, was actually a 3%
speed-up on Octane/regexp, not a slow-down as the ChangeLog claimed.

It discovered this bug because for each Octane test that I want to debug, I usually make
a standalone .js file that contains the whole test along with a miniharness - usually
a plain loop - that runs it almost like it would for real but with whatever hacks I'm
using for debugging. When I wrote such a thing for regexp, I used a ~20 iteration warmup
to match the one second of warmup that this benchmark gets in Octane. To my surprise,
this quite faithful regexp runner did not see the regression that run-jsc-benchmarks
saw. That's when I found out that run-jsc-benchmarks was running it wrong.

The reason for the no-warmup slow-down is that the FTL is actually fairly expensive to
run on some of these very large functions in the regexp benchmark. I don't think we can
do anything about that, and I'd argue that the speed-up we see after the compilation is
done suggests that it was worth it.

Scripts/run-jsc-benchmarks:

11:32 AM WebKitIDL edited by Chris Dumez

(diff)

11:31 AM WebKitIDL edited by Chris Dumez

[TreatNullAs=EmptyString] (diff)

10:55 AM Changeset in webkit [197360] by barraclough@apple.com

16 edits in trunk

RefCounter<T>::Event -> RefCounterEvent
https://bugs.webkit.org/show_bug.cgi?id=154767

Reviewed by Darin Adler.

RefCounter<T>::Event is kinda verbose to use, and there is no need for this
to be specific to a particular typeof RefCounter. Move the enum class up to
the top level & rename to RefCounterEvent.

Source/WebCore:

page/PageThrottler.cpp:

(WebCore::PageThrottler::PageThrottler):
(WebCore::m_audiblePluginHysteresis):
(WebCore::m_mediaActivityCounter):
(WebCore::m_pageLoadActivityCounter):

platform/VNodeTracker.cpp:

(WebCore::VNodeTracker::singleton):
(WebCore::VNodeTracker::VNodeTracker):
(WebCore::m_lastWarningTime):

Source/WebKit2:

Also remove UserObservablePageToken - this is vestigial & not really offering
anything over just using UserObservablePageCounter::Token directly.

UIProcess/Plugins/PluginProcessManager.cpp:

(WebKit::PluginProcessManager::PluginProcessManager):

UIProcess/Plugins/PluginProcessManager.h:
UIProcess/Plugins/mac/PluginProcessManagerMac.mm:

(WebKit::PluginProcessManager::updateProcessSuppressionDisabled):

UIProcess/ProcessThrottler.cpp:

(WebKit::ProcessThrottler::ProcessThrottler):
(WebKit::m_backgroundCounter):
(WebKit::m_suspendMessageCount):

UIProcess/ProcessThrottler.h:
UIProcess/WebPageProxy.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::WebProcessPool):
(WebKit::m_processSuppressionDisabledForPageCounter):
(WebKit::m_hiddenPageThrottlingAutoIncreasesCounter):

UIProcess/WebProcessPool.h:

Source/WTF:

wtf/RefCounter.h:

(WTF::RefCounter<T>::Count::ref):
(WTF::RefCounter<T>::Count::deref):

Tools:

TestWebKitAPI/Tests/WTF/RefCounter.cpp:

(TestWebKitAPI::TEST):

10:51 AM Changeset in webkit [197359] by youenn.fablet@crf.canon.fr

3 edits in trunk/LayoutTests

streams/pipe-to.html flaky on mac-wk1 debug
https://bugs.webkit.org/show_bug.cgi?id=154687

Reviewed by Darin Adler.

TestExpectations: Marking streams/pipe-to.html as slow.
streams/pipe-to.html: Increasing the timeout value.

10:33 AM Changeset in webkit [197358] by Csaba Osztrogonác

5 edits
1 delete in trunk/Tools

Remove more LLVM related cruft
https://bugs.webkit.org/show_bug.cgi?id=154821

Reviewed by Darin Adler.

Scripts/build-jsc:
Scripts/build-webkit:
Scripts/copy-webkitlibraries-to-product-directory:
Scripts/export-llvm-build: Removed.
Scripts/run-jsc-stress-tests:

10:05 AM Changeset in webkit [197357] by fpizlo@apple.com

8 edits
2 adds in trunk/Source/JavaScriptCore

FTL should be able to run everything in Octane/regexp
https://bugs.webkit.org/show_bug.cgi?id=154266

Reviewed by Saam Barati.

Adds FTL support for NewRegexp, RegExpTest, and RegExpExec. I couldn't figure out how to
make the RegExpExec peephole optimization work in FTL. This optimizations shouldn't be a
DFG backend optimization anyway - if we need this optimization then it should be a
strength reduction rule over IR. That way, it can be shared by all backends.

I measured whether removing that optimization had any effect on performance separately
from measuring the performance of this patch. Removing that optimization did not change
our score on any benchmarks.

This patch does have an overall negative effect on the Octane/regexp score. This is
presumably because tiering up to the FTL has no value to the code in the regexp test. Or
maybe it's something else. No matter - the overall effect on the Octane score is not
statistically significant and we don't want this kind of coverage blocked by the fact
that adding coverage hurts a benchmark.

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGNode.h:

(JSC::DFG::Node::setIndexingType):
(JSC::DFG::Node::hasRegexpIndex):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNotifyWrite):
(JSC::DFG::SpeculativeJIT::compileIsObjectOrNull):
(JSC::DFG::SpeculativeJIT::compileRegExpExec): Deleted.

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):

tests/stress/ftl-regexp-exec.js: Added.
tests/stress/ftl-regexp-test.js: Added.

9:54 AM Changeset in webkit [197356] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Unreviewed. Fix the build with GTK+ < 3.19.

platform/gtk/ScrollbarThemeGtk3.cpp:

(WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
(WebCore::ScrollbarThemeGtk::paintThumb):
(WebCore::ScrollbarThemeGtk::paintButton):

9:36 AM Changeset in webkit [197355] by Chris Dumez

4 edits in trunk

Use HTML parsing rules for textarea.maxLength
https://bugs.webkit.org/show_bug.cgi?id=154805

Reviewed by Andreas Kling.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/reflection-forms-expected.txt:

Source/WebCore:

Use HTML parsing rules for textarea.maxLength:

No new tests, already covered by existing test.

html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::maxLength):

9:32 AM Changeset in webkit [197354] by Chris Dumez

6 edits in trunk

Align td.rowSpan / td.colSpan with the specification
https://bugs.webkit.org/show_bug.cgi?id=154803

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/reflection-tabular-expected.txt:

Source/WebCore:

Align td.rowSpan / td.colSpan with the specification:

In particular, the following changes were made:

Change type from 'long' to 'unsigned long'.
Use HTML rules for parsing unsigned integers:
- https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers
Use 1 as default value when the input value is out of range instead of 0 when setting.
rowspan is still clamped to [1, 8190] internally but we now expose the unclamped value to JS as this is an internal restriction. The same is done for a colSpan value of 0, we expose 0 to the Web but clamp to 1 internally.

No new tests, already covered by existing test.

html/HTMLTableCellElement.cpp:

(WebCore::HTMLTableCellElement::colSpan):
(WebCore::HTMLTableCellElement::rowSpan):
(WebCore::HTMLTableCellElement::rowSpanForBindings):
(WebCore::HTMLTableCellElement::setColSpan):
(WebCore::HTMLTableCellElement::setRowSpanForBindings):
(WebCore::HTMLTableCellElement::axis): Deleted.
(WebCore::HTMLTableCellElement::headers): Deleted.

html/HTMLTableCellElement.h:
html/HTMLTableCellElement.idl:

9:28 AM Changeset in webkit [197353] by Chris Dumez

39 edits in trunk/Source/WebCore

[Web IDL] Add support for [TreatNullAs=EmptyString] and use it
https://bugs.webkit.org/show_bug.cgi?id=154654

Reviewed by Darin Adler.

Add support for [TreatNullAs=EmptyString] standard Web IDL extended
attribute:

http://heycam.github.io/webidl/#TreatNullAs

This replaces the WebKit-specific [TreatNullAs=NullString] IDL
extended attribute. Instead of passing a null String() to the
implementation, emptyString() is passed.

This patch does not cause any web-exposed behavior change. For
case where switching from NullString to EmptyString would change
the behavior (or require changes to the implementation), the old
IDL attribute was kept. However, it was renamed to
[TreatNullAs=LegacyNullString] to discourage its use in new code.
Eventually, this legacy IDL attribute should go away entirely.

[TreatNullAs=EmptyString] should only be used when it is present
in the corresponding specification. Note that there are a lot of
places where we use [TreatNullAs=EmptyString] in our IDL where it
does not match the specification. I have added FIXME comments for
those so we can clean them up later.

No new tests, no web-exposed behavior change.

Modules/mediastream/RTCPeerConnection.idl:

No behavior change because this is not implemented.

bindings/js/JSDOMBinding.cpp:

(WebCore::valueToStringTreatingNullAsEmptyString):

bindings/js/JSDOMBinding.h:

Add new function to convert a JSValue into a String while treating
null as the empty string.

bindings/scripts/CodeGeneratorJS.pm:

(JSValueToNative):

bindings/scripts/IDLAttributes.txt:
Add support for [TreatNullAs=EmptyString].
Rename NullString to LegacyNullString to discourage its use.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:
bindings/scripts/test/TestObj.idl:

Add bindings tests coverage for [TreatNullAs=EmptyString].

css/CSSStyleDeclaration.idl:
dom/CharacterData.idl:
dom/DOMImplementation.idl:
dom/Document.idl:
dom/Element.idl:
dom/ShadowRoot.idl:
html/HTMLOutputElement.idl:
html/HTMLScriptElement.idl:
html/URLUtils.idl:
svg/SVGAngle.idl:
svg/SVGLength.idl:

Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString].
There is not behavior change because the implementation does
not distinguish the null string from the empty string.

html/HTMLBaseElement.idl:
html/HTMLButtonElement.idl:
html/HTMLFormElement.idl:
html/HTMLMediaElement.idl:
html/HTMLSelectElement.idl:
svg/SVGElement.idl:
svg/SVGScriptElement.idl:

Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString],
no behavior change.

html/HTMLDocument.idl:
dir and *Color: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].
designMode: Drop [TreatNullAs=NullString] as per the specification:
- https://html.spec.whatwg.org/multipage/dom.html#the-document-object null now gets converted to "null" instead of the null String but this does not change behavior because the implementation only recognizes "on" / "off" / others. So we still end up using inherit mode when set to null.

html/HTMLElement.idl:
Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString] for innerText / outerText. Does not change behavior because the implementation does not distinguishes.
Drop [TreatNullAs=NullString] from contentEditable to match the spec:
- https://html.spec.whatwg.org/multipage/interaction.html#elementcontenteditable This does not change behavior because the implementation will the a SyntaxError wether a null String or the string "null" is passed.

html/HTMLFrameElement.idl:

Drop [TreatNullAs=NullString] from location attribute. This does not
change behavior because the attribute is using a custom setter.

html/HTMLInputElement.idl:
formEnctype / formMethod / autocapitalize: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].
value: Rename [TreatNullAs=NullString] to Rename [TreatNullAs=EmptyString], which does not change behavior because the implementation does not distinguish. Also drop the extended attribute for non-JS bindings as it has no impact.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setMediaGroup):
Drop redundant group.isNull() check as group.isEmpty() already checks for null.

html/HTMLScriptElement.cpp:

(WebCore::HTMLScriptElement::setText):
Drop useless .impl() call as we have a String and the method requires a String
as input.

html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::setValueCommon):
Use emptyString() instead of "" as it is slightly more efficient.

html/HTMLTextAreaElement.idl:
value: Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString]. No behavior change because the implementation does not distinguish.
autocapitalize: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].

html/canvas/CanvasRenderingContext2D.idl:
globalCompositeOperation / repetitionType: Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString]. No behavior change because the implementation does not distinguish.
lineCap / lineJoin: Drop the [TreatNullAs=NullString] to match the spec:
- https://html.spec.whatwg.org/multipage/scripting.html#canvaspathdrawingstyles There is no behavior change because those are string enumerations and the value is not recognized either way (String() or String("null")).
shadowColor: Drop the [TreatNullAs=NullString] to match the spec:
- https://html.spec.whatwg.org/multipage/scripting.html#canvasshadowstyles No behavior change because this is not a valid color either way.

7:03 AM Changeset in webkit [197352] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit2

Fixed compilation with !ENABLE(DATABASE_PROCESS).
https://bugs.webkit.org/show_bug.cgi?id=154813

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-29
Reviewed by Michael Catanzaro.

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::terminateDatabaseProcess): Added missing #if
guard.

7:01 AM Changeset in webkit [197351] by commit-queue@webkit.org

4 edits in trunk

[GTK] Touch slider test fails due to assertion in webkitWebViewBaseTouchEvent()
https://bugs.webkit.org/show_bug.cgi?id=153829

Patch by Adrien Plazas <aplazas@igalia.com> on 2016-02-29
Reviewed by Carlos Garcia Campos.

Source/WebKit2:

Once a touch event sequence is identified as a gesture, remove it
from the list of handled touch events.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewBaseTouchEvent):

LayoutTests:

platform/gtk/TestExpectations:

Remove now passing tests from the expected failures.

6:59 AM Changeset in webkit [197350] by commit-queue@webkit.org

2 edits in trunk

[cmake] Allow using FindGLIB in case glib is optional dependency.
https://bugs.webkit.org/show_bug.cgi?id=154796

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-29
Reviewed by Michael Catanzaro.

FindGLIB caused internal CMake error in case glibconfig.h is not
found.

Source/cmake/FindGLIB.cmake:

5:32 AM Changeset in webkit [197349] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197303 - Shrink UnlinkedCodeBlock a bit."

This reverts commit 200002afed4ac67e3cff10bfa9d7e32d879c9a1f.

5:32 AM Changeset in webkit [197348] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Revert "Merge r197305 - REGRESSION(r197303): 4 jsc tests failing on bots."

This reverts commit 497aed24c9437e5d994322493011412097672fab.

5:01 AM Changeset in webkit [197347] by youenn.fablet@crf.canon.fr

6 edits in trunk/Source/WebCore

Refactor FetchBody constructors
https://bugs.webkit.org/show_bug.cgi?id=154721

Reviewed by Sam Weinig and Darin Adler.

Covered by existing tests.

Modules/fetch/FetchBody.cpp:

(WebCore::FetchBody::extract): Renamed from "fromJSValue"
(WebCore::FetchBody::extractFromBody): Renamed from "fromRequestBody" and making use of move constructor.

Modules/fetch/FetchBody.h:

(WebCore::FetchBody::FetchBody): Making default constructor public and removing empty static method.

Modules/fetch/FetchRequest.cpp:

(WebCore::buildBody):

Modules/fetch/FetchResponse.cpp:

(WebCore::FetchResponse::error):
(WebCore::FetchResponse::redirect):
(WebCore::FetchResponse::initializeWith):

Modules/fetch/FetchResponse.h:

(WebCore::FetchResponse::create):

3:47 AM Changeset in webkit [197346] by Csaba Osztrogonác

2 edits in trunk/Source/WebKit2

[Mac][cmake] Unreviewed buildfix after r197177. Just for fun.

PlatformMac.cmake:

3:45 AM Changeset in webkit [197345] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197305 - REGRESSION(r197303): 4 jsc tests failing on bots.

Unreviewed follow-up fix.

bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): This function
can still get called with !m_rareData, in case the type profiler is active but this
particular code block doesn't have type profiler data. Handle it gracefully.

3:45 AM Changeset in webkit [197344] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197303 - Shrink UnlinkedCodeBlock a bit.
<https://webkit.org/b/154797>

Reviewed by Anders Carlsson.

Move profiler-related members of UnlinkedCodeBlock into its RareData
structure, saving 40 bytes, and then reorder the other members of
UnlinkedCodeBlock to save another 24 bytes, netting a nice total 64.

The VM member was removed entirely since UnlinkedCodeBlock is a cell
and can retrieve its VM through MarkedBlock header lookup.

bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::vm):
(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset):
(JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.

bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::addRegExp):
(JSC::UnlinkedCodeBlock::addConstant):
(JSC::UnlinkedCodeBlock::addFunctionDecl):
(JSC::UnlinkedCodeBlock::addFunctionExpr):
(JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset):
(JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets):
(JSC::UnlinkedCodeBlock::vm): Deleted.

3:31 AM Changeset in webkit [197343] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r197300 - Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
https://bugs.webkit.org/show_bug.cgi?id=154785

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/css/variables/avoid-matched-property-cache.html

css/StyleResolver.cpp:

(WebCore::StyleResolver::MatchResult::addMatchedProperties):
Disable the matched property cache when a value is variable-dependent, because
they can resolve to inherited values, and the matched property cache could
end up copying the wrong value from another similarly-styled element.

LayoutTests:

fast/css/variables/avoid-matched-property-cache-expected.html: Added.
fast/css/variables/avoid-matched-property-cache.html: Added.

Add a test. The non-standard element is necessary because the resolved property
cache is already disabled when using the "simple" default style sheet, and
it seems better to use a totally non-standard element than one that might
end up in the "simple" default style sheet in the future and would silently
invalidate the test.

3:30 AM Changeset in webkit [197342] by Carlos Garcia Campos

10 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197299 - FTL should lower its abstract heaps to B3 heap ranges
https://bugs.webkit.org/show_bug.cgi?id=154782

Reviewed by Saam Barati.

The FTL can describe the abstract heaps (points-to sets) that a memory operation will
affect. The abstract heaps are arranged as a hierarchy. We used to transform this into
TBAA hierarchies in LLVM, but we never got around to wiring this up to B3's equivalent
notion - the HeapRange. That's what this patch fixes.

B3 has a minimalistic alias analysis. It represents abstract heaps using unsigned 32-bit
integers. There are 1<<32 abstract heaps. The B3 client can describe what an operation
affects by specifying a heap range: a begin...end pair that says that the operation
affects all abstract heaps H such that begin <= H < end.

This peculiar scheme was a deliberate attempt to distill what the abstract heap
hierarchy is all about. We can assign begin...end numbers to abstract heaps so that:

A heap's end is greater than its begin.
A heap's begin is greater than or equal to its parent's begin.
A heap's end is less than or equal to its parent's end.

This is easy to do using a recursive traversal of the abstract heap hierarchy. I almost
went for the iterative traversal, which is a splendid algorithm, but it's totally
unnecessary here since we tightly control the height of the heap hierarchy.

Because abstract heaps are produced on-the-fly by FTL lowering, due to the fact that we
generate new ones for field names and constant indices we encounter, we can't actually
decorate the B3 instructions we create in lowering until all lowering is done. Adding a
new abstract heap to the hierarchy after ranges were already computed would require
updating the ranges of any heaps "to the right" of that heap in the hierarchy. This
patch solves that problem by recording the associations between abstract heaps and their
intended roles in the generated IR, and then decorating all of the relevant B3 values
after we compute the ranges of the hierarchy after lowering.

This is perf-neutral. I was hoping for a small speed-up, but I could not detect a
speed-up on any benchmark. That's not too surprising. We already have very precise CSE
in the DFG, so there aren't many opportunities left for the B3 CSE and it may have
already been getting the big ones even without alias analysis.

Even without a speed-up, this patch is valuable because it makes it easier to implement
other optimizations, like store elimination.

b3/B3HeapRange.h:

(JSC::B3::HeapRange::HeapRange):

ftl/FTLAbstractHeap.cpp:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::changeParent):
(JSC::FTL::AbstractHeap::compute):
(JSC::FTL::AbstractHeap::shallowDump):
(JSC::FTL::AbstractHeap::dump):
(JSC::FTL::AbstractHeap::deepDump):
(JSC::FTL::AbstractHeap::badRangeError):
(JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
(JSC::FTL::IndexedAbstractHeap::baseIndex):
(JSC::FTL::IndexedAbstractHeap::atSlow):
(JSC::FTL::IndexedAbstractHeap::initialize):
(JSC::FTL::AbstractHeap::decorateInstruction): Deleted.
(JSC::FTL::AbstractField::dump): Deleted.

ftl/FTLAbstractHeap.h:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::isInitialized):
(JSC::FTL::AbstractHeap::initialize):
(JSC::FTL::AbstractHeap::parent):
(JSC::FTL::AbstractHeap::heapName):
(JSC::FTL::AbstractHeap::range):
(JSC::FTL::AbstractHeap::offset):
(JSC::FTL::IndexedAbstractHeap::atAnyIndex):
(JSC::FTL::IndexedAbstractHeap::at):
(JSC::FTL::IndexedAbstractHeap::operator[]):
(JSC::FTL::IndexedAbstractHeap::returnInitialized):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::constructDeletedValue):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::isDeletedValue):
(JSC::FTL::AbstractHeap::changeParent): Deleted.
(JSC::FTL::AbstractField::AbstractField): Deleted.
(JSC::FTL::AbstractField::initialize): Deleted.
(JSC::FTL::AbstractField::offset): Deleted.

ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::~AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::decorateMemory):
(JSC::FTL::AbstractHeapRepository::decorateCCallRead):
(JSC::FTL::AbstractHeapRepository::decorateCCallWrite):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointRead):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointWrite):
(JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):

ftl/FTLAbstractHeapRepository.h:

(JSC::FTL::AbstractHeapRepository::forArrayType):
(JSC::FTL::AbstractHeapRepository::HeapForValue::HeapForValue):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

ftl/FTLOutput.cpp:

(JSC::FTL::Output::load):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::store):
(JSC::FTL::Output::store32As8):
(JSC::FTL::Output::store32As16):
(JSC::FTL::Output::baseIndex):

ftl/FTLOutput.h:

(JSC::FTL::Output::address):
(JSC::FTL::Output::absolute):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::load32):
(JSC::FTL::Output::load64):
(JSC::FTL::Output::loadPtr):
(JSC::FTL::Output::loadDouble):
(JSC::FTL::Output::store32):
(JSC::FTL::Output::store64):
(JSC::FTL::Output::storePtr):
(JSC::FTL::Output::storeDouble):
(JSC::FTL::Output::ascribeRange):
(JSC::FTL::Output::nonNegative32):
(JSC::FTL::Output::load32NonNegative):
(JSC::FTL::Output::equal):
(JSC::FTL::Output::notEqual):

ftl/FTLTypedPointer.h:

(JSC::FTL::TypedPointer::operator!):
(JSC::FTL::TypedPointer::heap):
(JSC::FTL::TypedPointer::value):

3:21 AM Changeset in webkit [197341] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197298 - SVGToOTFFontConversion.cpp does not compile with libstdc++ 4.8
https://bugs.webkit.org/show_bug.cgi?id=154794

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.

No new tests needed.

svg/SVGToOTFFontConversion.cpp:

(WebCore::SVGToOTFFontConverter::appendLigatureSubtable): Added const
qualifiers.

3:20 AM Changeset in webkit [197340] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r197265 - Web Inspector: DataGrid's resizers aren't horizontally centered
https://bugs.webkit.org/show_bug.cgi?id=154787
<rdar://problem/24876901>

Reviewed by Timothy Hatcher.

UserInterface/Views/DataGrid.css:

(.data-grid .resizer):
Use CSS transforms as margin-left doesn't support sub-pixel values.

3:19 AM Changeset in webkit [197339] by Carlos Garcia Campos

10 edits in releases/WebKitGTK/webkit-2.12

Merge r197263 - Prevent cross-origin access to Location.assign() / Location.reload()
https://bugs.webkit.org/show_bug.cgi?id=154779

Reviewed by Darin Adler.

Source/WebCore:

Prevent cross-origin access to Location.assign() / Location.reload()
to match the latest specification:

https://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)

Firefox and Chrome already prevent this but WebKit allowed it.

No new tests, already covered by existing tests.

bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::getOwnPropertySlotDelegate):
(WebCore::JSLocation::putDelegate): Deleted.

LayoutTests:

Update existing layout tests now that we prevent cross-origin access to
Location.assign() / Location.reload().

http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:
http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:
http/tests/security/cross-frame-access-location-get-expected.txt:
http/tests/security/cross-frame-access-location-get-override-expected.txt:
http/tests/security/cross-frame-access-location-get-override.html:
http/tests/security/cross-frame-access-location-get.html:
http/tests/security/xss-DENIED-defineProperty-expected.txt:

3:17 AM Changeset in webkit [197338] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197256 - CLoop build fix.

3:16 AM Changeset in webkit [197337] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r197245 - Web Inspector: Increase clickable area of the console prompt
https://bugs.webkit.org/show_bug.cgi?id=154719
<rdar://problem/24854538>

Reviewed by Timothy Hatcher.

Clicking on the area around CodeMirror element now moves
focus to the console prompt.

UserInterface/Views/QuickConsole.js:

(WebInspector.QuickConsole.prototype._handleMouseDown):
Only capture mousedown events on .quick-console.
Don't capture clicks on CodeMirror.

UserInterface/Views/QuickConsole.css:

(.quick-console > .console-prompt):
(.quick-console > .console-prompt > .CodeMirror):
Make sure .console-prompt is never an event.target for _handleMouseDown.

3:16 AM Changeset in webkit [197336] by Carlos Garcia Campos

8 edits in releases/WebKitGTK/webkit-2.12/Source

Merge r197244 - Network cache: old pages returned by disk cache on history navigation after session is restored
https://bugs.webkit.org/show_bug.cgi?id=153230

Reviewed by Chris Dumez.

Source/WebCore:

Add a flag to HistoryItem to mark them as restored from session
and use it from the FrameLoader to not change the policy request
when navigating to a history item that was restored from session,
except for iOS port.

history/HistoryItem.h:

(WebCore::HistoryItem::setWasRestoredFromSession):
(WebCore::HistoryItem::wasRestoredFromSession):

loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadDifferentDocumentItem):

Source/WebKit2:

Since r181734, the network cache never revalidates resources for
history navigation. This is good for the memory cache, but in the
case of disk cache, we might end up with outdated pages when
restoring the session. When restoring the session happens because
of an API request (we also restore the session when recovering
from a web process crash), we should revalidate back forward list
requests in the disk cache if needed. This will only happen the
first time they are loaded after a session restore. After a web process
crash, resources will be used uncondionally from the disk cache.

WebProcess/WebPage/WebBackForwardListProxy.cpp:

(WebKit::WebBackForwardListProxy::addItemFromUIProcess): Use Ref&&
instead of PassRefPtr.

WebProcess/WebPage/WebBackForwardListProxy.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WePage::WebPage): Call restoreSessionInternal passing
No as restoredByAPIRequest parameter.
(WebKit::WebPage::restoreSessionInternal): Set restoredFromSession
flag to the created HistoryItem if the item was restored from
session by an API request.
(WebKit::WebPage::restoreSession): Call restoreSessionInternal
passing Yes as restoredByAPIRequest parameter.

WebProcess/WebPage/WebPage.h:

3:14 AM Changeset in webkit [197335] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r197242 - REGRESSION (r196741): Web Inspector: Bottom section of Layers sidebar is 1px shorter than the console prompt
https://bugs.webkit.org/show_bug.cgi?id=154773
<rdar://problem/24873345>

Reviewed by Timothy Hatcher.

UserInterface/Views/LayerTreeDetailsSidebarPanel.css:

(.sidebar > .panel.details.layer-tree > .content):
(.panel.details.layer-tree .bottom-bar):

3:13 AM Changeset in webkit [197334] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r197236 - [GTK] Fix order of parameters in gtkdoc for webkit_web_view_get_snapshot

Unreviewed.

UIProcess/API/gtk/WebKitWebView.cpp:

3:12 AM Changeset in webkit [197333] by Carlos Garcia Campos

10 edits
1 delete in releases/WebKitGTK/webkit-2.12/Source

Merge r197226 - Remove the on demand executable allocator
https://bugs.webkit.org/show_bug.cgi?id=154749

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Remove all the DemandExecutable code and executable allocator ifdefs.

CMakeLists.txt:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
JavaScriptCore.xcodeproj/project.pbxproj:
jit/ExecutableAllocator.cpp: Removed.

(JSC::DemandExecutableAllocator::DemandExecutableAllocator): Deleted.
(JSC::DemandExecutableAllocator::~DemandExecutableAllocator): Deleted.
(JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators): Deleted.
(JSC::DemandExecutableAllocator::bytesCommittedByAllocactors): Deleted.
(JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators): Deleted.
(JSC::DemandExecutableAllocator::allocateNewSpace): Deleted.
(JSC::DemandExecutableAllocator::notifyNeedPage): Deleted.
(JSC::DemandExecutableAllocator::notifyPageIsFree): Deleted.
(JSC::DemandExecutableAllocator::allocators): Deleted.
(JSC::DemandExecutableAllocator::allocatorsMutex): Deleted.
(JSC::ExecutableAllocator::initializeAllocator): Deleted.
(JSC::ExecutableAllocator::ExecutableAllocator): Deleted.
(JSC::ExecutableAllocator::~ExecutableAllocator): Deleted.
(JSC::ExecutableAllocator::isValid): Deleted.
(JSC::ExecutableAllocator::underMemoryPressure): Deleted.
(JSC::ExecutableAllocator::memoryPressureMultiplier): Deleted.
(JSC::ExecutableAllocator::allocate): Deleted.
(JSC::ExecutableAllocator::committedByteCount): Deleted.
(JSC::ExecutableAllocator::dumpProfile): Deleted.
(JSC::ExecutableAllocator::getLock): Deleted.
(JSC::ExecutableAllocator::isValidExecutableMemory): Deleted.
(JSC::ExecutableAllocator::reprotectRegion): Deleted.

jit/ExecutableAllocator.h:
jit/ExecutableAllocatorFixedVMPool.cpp:
jit/JITStubRoutine.h:

(JSC::JITStubRoutine::canPerformRangeFilter): Deleted.
(JSC::JITStubRoutine::filteringStartAddress): Deleted.
(JSC::JITStubRoutine::filteringExtentSize): Deleted.

Source/WTF:

Remove the DeamndExecutableAllocator compile flags.

wtf/Platform.h:

2:40 AM Changeset in webkit [197332] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197210 - Reduce direct callers of Structure::findStructuresAndMapForMaterialization
https://bugs.webkit.org/show_bug.cgi?id=154751

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-26
Reviewed by Mark Lam.

runtime/Structure.cpp:

(JSC::Structure::toStructureShape):
This property name iteration is identical to Structure::forEachPropertyConcurrently.
Share the code and reduce callers to the subtle findStructuresAndMapForMaterialization.

2:33 AM Changeset in webkit [197331] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197196 - Folding of OverridesHasInstance DFG nodes shoud happen in constant folding not fixup
https://bugs.webkit.org/show_bug.cgi?id=154743

Reviewed by Mark Lam.

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

2:26 AM Changeset in webkit [197330] by Carlos Garcia Campos

4 edits
1 add
6 deletes in releases/WebKitGTK/webkit-2.12

Merge r197194 - <g> wrapping <symbol> causes display of hidden <symbol>
https://bugs.webkit.org/show_bug.cgi?id=154576

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-02-26
Reviewed by Darin Adler.
Source/WebCore:

The SVGSymbolElement is allowed in the shadow tree of an SVGUseElement
only if it subtree root element. Any descendant SVGSymbolElement should
be removed from the subtree because it is a hidden container. If the cloned
subtree includes an SVGUseElement which references an SVGSymbolElement,
the same rule will be applied to the descendant SVGUseElement. The goal
is to remove all the descendant SVGSymbolElements from the cloned target
because these SVGSymbolElements will be expanded to SVGSVGElements and
hence become visible.

svg/SVGUseElement.cpp:

(WebCore::disassociateAndRemoveClones): A helper function which removes
cloned SVGElements and their subtrees from their parents and disassociate
them from their originals.

(WebCore::removeDisallowedElementsFromSubtree): Use disassociateAndRemoveClones().

(WebCore::removeSymbolElementsFromSubtree): Removes all the descendant
SVGSymbolElements from the cloned subtree. It does not remove the root
element itself if it is an SVGSymbolElement because this one will be
expanded to an SVGSVGElement which is exactly what we need.

(WebCore::SVGUseElement::cloneTarget): Call removeSymbolElementsFromSubtree()
to remove the descendant SVGSymbolElements from the cloned subtree before
appending it to the container shadow root.

LayoutTests:

Ensure the <symbol> element is not displayed when it's wrapped in a <g>
element and this <g> element is referenced by a <use> element.

platform/gtk/svg/custom/use-on-g-containing-symbol-expected.png: Removed.
platform/gtk/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
platform/ios-simulator/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
platform/mac/svg/custom/use-on-g-containing-symbol-expected.png: Removed.
platform/mac/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
platform/win/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
svg/custom/use-on-g-containing-symbol-expected.svg: Added.
svg/custom/use-on-g-containing-symbol.svg:

The original test was wrong. It had the following definition:

"<g id='symbol'><symbol>...</symbol></g>"

And it was expecting to have the symbol drawn if the <g> element was
referenced like that

"<use xlink:href='#symbol'/>"

FireFox does not render anything for this <use> element which is correct.
With this patch, this test failed so it had to be modified to test the right
behavior. Also it is now converted to a ref test.

2:23 AM Changeset in webkit [197329] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197186 - [JSC] Add32(Imm, Tmp, Tmp) does not ZDef the destination if Imm is zero
https://bugs.webkit.org/show_bug.cgi?id=154704

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-26
Reviewed by Geoffrey Garen.

If the Imm is zero, we should still zero the top bits
to match the definition in AirOpcodes.

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::add32):

b3/testb3.cpp:

2:08 AM Changeset in webkit [197328] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r197180 - Cache::traverse should pass the record info to its traversal handler
https://bugs.webkit.org/show_bug.cgi?id=154695

Reviewed by Antti Koivisto.

NetworkProcess/NetworkProcess.cpp:

(WebKit::fetchDiskCacheEntries):
(WebKit::clearDiskCacheEntries):

NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::Cache::traverse):

NetworkProcess/cache/NetworkCache.h:

2:06 AM Changeset in webkit [197327] by commit-queue@webkit.org

2 edits in trunk

Unreviewed, rolling out r197297.
https://bugs.webkit.org/show_bug.cgi?id=154810

This change broke build of GTK from scratch (Requested by
annulen on #webkit).

Reverted changeset:

"[cmake] Allow using FindGLIB in case glib is optional
dependency."
https://bugs.webkit.org/show_bug.cgi?id=154796
http://trac.webkit.org/changeset/197297

2:03 AM Changeset in webkit [197326] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r197169 - Web Inspector: Option-clicking on the a CSS property sometimes doesn't work
https://bugs.webkit.org/show_bug.cgi?id=154384
<rdar://problem/24714755>

Patch by Devin Rousso <Devin Rousso> on 2016-02-26
Reviewed by Timothy Hatcher.

It seems as though there were race conditions between CodeMirror's event
and the native mousemove such that if CodeMirror fired second, the current
candidate was cleared, and would not reset itself until the cursor was
moved, at which point the same issue could happen. To fix this, the current
candidate is no longer cleared by CodeMirror's event and is instead only
modified by the native mouse-events.

UserInterface/Controllers/CodeMirrorTokenTrackingController.js:

(WebInspector.CodeMirrorTokenTrackingController.prototype._hidePopover):

2:02 AM Changeset in webkit [197325] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197164 - [DFG] Drop unnecessary proved type branch in ToPrimitive
https://bugs.webkit.org/show_bug.cgi?id=154716

Reviewed by Geoffrey Garen.

This branching based on the proved types is unnecessary because this is already handled in constant folding phase.
In fact, the DFGSpeculativeJIT64.cpp case is already removed in r164243.
This patch removes the remaining JIT32_64 case.

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

2:02 AM Changeset in webkit [197324] by Carlos Garcia Campos

8 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197159 - [JSC] Be aggressive with OSR Entry to FTL if the DFG function was only used for OSR Entry itself
https://bugs.webkit.org/show_bug.cgi?id=154575

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-25
Reviewed by Filip Pizlo.

I noticed that imaging-gaussian-blur spends most of its
samples in DFG code despite executing most of the loop
iterations in FTL.

On this particular test, the main function is only entered
once and have a very heavy loop there. What happens is DFG
starts by compiling the full function in FTL. That takes about
8 to 10 milliseconds during which the DFG code makes very little
progress. The calls to triggerOSREntryNow() try to OSR Enter
for a while then finally start compiling something. By the time
the function is ready, we have wasted a lot of time in DFG code.

What this patch does is set a flag when a DFG function is entered.
If we try to triggerOSREntryNow() and the flag was never set,
we start compiling both the full function and the one for OSR Entry.

dfg/DFGJITCode.h:
dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileEntryExecutionFlag):
(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

dfg/DFGJITCompiler.h:
dfg/DFGOperations.cpp:
dfg/DFGPlan.cpp:

(JSC::DFG::Plan::Plan): Deleted.

dfg/DFGPlan.h:
dfg/DFGTierUpCheckInjectionPhase.cpp:

(JSC::DFG::TierUpCheckInjectionPhase::run):

1:53 AM Changeset in webkit [197323] by Carlos Garcia Campos

2 edits
1 add in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197155 - [JSC] Temporal Dead Zone checks on "this" are eliminated when doing OSR Entry to FTL
https://bugs.webkit.org/show_bug.cgi?id=154664

Reviewed by Saam Barati.

When doing OSR Enter into a constructor, we lose the information
that this may have been set to empty by a previously executed block.

All the code just assumed the type for a FlushedJS value and thus
not an empty value. It was then okay to eliminate the TDZ checks.

In this patch, the values on root entry now assume they may be empty.
As a result, the SetArgument() for "this" has "empty" as possible
type and the TDZ checks are no longer eliminated.

dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::initialize):

[JSC] Add the test for r197155
https://bugs.webkit.org/show_bug.cgi?id=154715

Reviewed by Mark Lam.

Silly me. I forgot the test in the latest patch update.

tests/stress/class-syntax-tdz-osr-entry-in-loop.js: Added.

1:45 AM Changeset in webkit [197322] by Carlos Garcia Campos

14 edits
34 deletes in releases/WebKitGTK/webkit-2.12

Merge r197142 - CSP: Remove SecurityPolicy script interface
https://bugs.webkit.org/show_bug.cgi?id=154694
<rdar://problem/24846482>

Reviewed by Andy Estes.

Source/WebCore:

Remove the Content Security Policy script interface, SecurityPolicy. This interface was only
enabled when building with ENABLE(CSP_NEXT) (disabled by default).

For completeness, the SecurityPolicy interface was removed from the Content Security Policy 1.1 spec.
in <https://github.com/w3c/webappsec/commit/18882953ce2d8afca25f685557fef0e0471b2c9a> (12/26/2013).

CMakeLists.txt: Remove files to DOMSecurityPolicy.{cpp, idl}.
DerivedSources.cpp: Remove file JSDOMSecurityPolicy.cpp.
DerivedSources.make: Remove file DOMSecurityPolicy.idl.
PlatformGTK.cmake: Ditto.
PlatformMac.cmake: Ditto.
WebCore.xcodeproj/project.pbxproj: Remove files DOMSecurityPolicy files.
bindings/scripts/CodeGeneratorGObject.pm: Remove reference to DOMSecurityPolicy.
dom/Document.cpp:

(WebCore::Document::securityPolicy): Deleted.

dom/Document.h:
dom/Document.idl: Remove attribute securityPolicy.
page/DOMSecurityPolicy.cpp: Removed.
page/DOMSecurityPolicy.h: Removed.
page/DOMSecurityPolicy.idl: Removed.

LayoutTests:

Remove SecurityPolicy tests and update platform-specific expected results as needed.

http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi.html: Removed.
http/tests/security/contentSecurityPolicy/resources/securitypolicy-tests-base.js: Removed.
platform/gtk/js/dom/global-constructors-attributes-expected.txt: Update expected result as needed.
platform/win/js/dom/global-constructors-attributes-expected.txt: Ditto.

1:27 AM Changeset in webkit [197321] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197141 - Don't clear the weak JSString cache on memory pressure.
<https://webkit.org/b/154693>

Reviewed by Antti Koivisto.

This was stupid. The cache is a WeakGCMap, so all the JSStrings pointed to are
still alive anyway. This way we keep the ability to deduplicate common strings.

platform/MemoryPressureHandler.cpp:

(WebCore::MemoryPressureHandler::releaseNoncriticalMemory): Deleted.

1:25 AM Changeset in webkit [197320] by Carlos Garcia Campos

4 edits
1 delete in releases/WebKitGTK/webkit-2.12/LayoutTests

Merge r197138 - Unreviewed test gardening.

Fix a test flake where order doesn't matter.

platform/wk2/storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt: Removed.
storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt:
storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-private-expected.txt:
storage/indexeddb/resources/deletedatabase-delayed-by-open-and-versionchange.js:

(prepareDatabase.request.onblocked):
(onOpenSuccess):

1:25 AM Changeset in webkit [197319] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197134 - [JSC] Remove a useless "Move" in the lowering of Select
https://bugs.webkit.org/show_bug.cgi?id=154670

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-25
Reviewed by Geoffrey Garen.

I left the Move instruction when creating the aliasing form
of Select.

On ARM64, that meant a useless move for any case that can't
be coalesced.

On x86, that meant an extra constraint on child2, making it
stupidly hard to alias child1.

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::createSelect): Deleted.

1:15 AM Changeset in webkit [197318] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197125 - REGRESSION (r196268): Many assertion failures and crashes on SVG path animation tests when JS garbage collection happens quickly
https://bugs.webkit.org/show_bug.cgi?id=154331

Reviewed by Darin Adler.

This is not an actual regression. The bug did exist before r196268 but
the whole document was leaking once an SVGAnimatedProperty was created
so there was no way to produce this bug. After fixing the leak, one crash
and one assert got uncovered. Both of them happen because of the fact:
"if an SVGAnimatedProperty is not referenced it will be deleted."

svg/SVGPathElement.cpp:

(WebCore::SVGPathElement::lookupOrCreateDWrapper):
The code in this function was assuming that the wrapper will be created
only once which happens when SVGAnimatedProperty::lookupOrCreateWrapper()
is called. Before making this single call, lookupOrCreateDWrapper() was
building an initial SVGPathSegList from byte stream. But now
SVGAnimatedProperty::lookupWrapper() can return false even after creating
the SVGAnimatedProperty because it was deleted later. Calling
buildSVGPathSegListFromByteStream() more than once was causing
SVGAnimatedListPropertyTearOff::animationStarted() to fire the assertion
ASSERT(m_values.size() == m_wrappers.size()) because the path segments were
appended twice to m_values which is in fact SVGPathElement::m_pathSegList.value.
The fix is to build the initial SVGPathSegList only once which should happen
when m_pathSegList.value.isEmpty().

(WebCore::SVGPathElement::animatedPropertyWillBeDeleted):

svg/SVGPathElement.h:
svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:

(WebCore::SVGAnimatedPathSegListPropertyTearOff::~SVGAnimatedPathSegListPropertyTearOff):
SVGPathElement is assuming the following equivalence relation:
m_pathSegList.shouldSynchronize ~ SVGAnimatedProperty_is_created_and_not_null.
SVGPathElement::animatedPathSegList() and animatedNormalizedPathSegList()
set m_pathSegList.shouldSynchronize to true when SVGAnimatedProperty is
created but nothing sets m_pathSegList.shouldSynchronize back to false.
This was not a problem when the SVGAnimatedProperty was leaking but after
ensuring it is deleted when it is not referenced this equivalence relation
becomes untrue sometimes. This caused SVGPathElement::svgAttributeChanged()
to crash when we check m_pathSegList.shouldSynchronize and if it is true we
assume that SVGAnimatedProperty::lookupWrapper() will return a non-null pointer
and therefore we deference this pointer and call SVGAnimatedProperty::isAnimating().
To fix this crash we need to set m_pathSegList.shouldSynchronize back to false
when the associated SVGAnimatedProperty is deleted.

1:13 AM Changeset in webkit [197317] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r197123 - HashMap::ensure() should return an AddResult like all the other add-like functions.
https://bugs.webkit.org/show_bug.cgi?id=154680

Reviewed by Anders Carlsson.

While adopting HashMap::ensure(), I found it was useful in some circumstances to know
if the value was added or not. While I could discern this information by setting a bool
in the passed in lambda, it seemed clearer and more idiomatic to just have ensure return
an AddResult like all the other add-like functions do.

wtf/HashMap.h:

Change return type of HashMap::ensure() to be an AddResult.

Tools:
HashMap::ensure() should return an AddResult like all the other add-like functions
https://bugs.webkit.org/show_bug.cgi?id=154680

Reviewed by Anders Carlsson.

TestWebKitAPI/Tests/WTF/HashMap.cpp:

(TestWebKitAPI::TEST):
Update tests to use/test the new AddResult result.

12:36 AM Changeset in webkit [197316] by Antti Koivisto

3 edits
2 adds in trunk

::slotted doesn't work in nested shadow trees
https://bugs.webkit.org/show_bug.cgi?id=154765
<rdar://problem/24870995>

Reviewed by Ryosuke Niwa.

Source/WebCore:

See https://github.com/w3c/webcomponents/issues/331#issuecomment-189191593

Test: fast/shadow-dom/css-scoping-shadow-slotted-nested.html

css/ElementRuleCollector.cpp:

(WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):

Collect ::slotted rules from all the nested shadow trees instead of just the host's.

LayoutTests:

fast/shadow-dom/css-scoping-shadow-slotted-nested-expected.html: Added.
fast/shadow-dom/css-scoping-shadow-slotted-nested.html: Added.

Feb 28, 2016:

11:36 PM Changeset in webkit [197315] by Carlos Garcia Campos

9 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197306 - Reduce uses of PassRefPtr in indexeddb
https://bugs.webkit.org/show_bug.cgi?id=154273

Reviewed by Darin Adler.

No new tests, no behavior changes.

Modules/indexeddb/IDBDatabaseError.h:

(WebCore::IDBDatabaseError::create):

Modules/indexeddb/IDBKeyData.cpp:

(WebCore::IDBKeyData::maybeCreateIDBKey):

Modules/indexeddb/IDBKeyData.h:
Modules/indexeddb/IDBKeyRange.cpp:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::IDBKeyRange):
(WebCore::IDBKeyRange::only):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

Modules/indexeddb/IDBKeyRange.h:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::lower):
(WebCore::IDBKeyRange::upper):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

Modules/indexeddb/IDBKeyRangeData.cpp:

(WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange):

Modules/indexeddb/IDBKeyRangeData.h:
Modules/indexeddb/IDBServerConnection.h:
Modules/indexeddb/legacy/IDBCallbacks.h:
Modules/indexeddb/legacy/IDBCursorBackend.cpp:

(WebCore::IDBCursorBackend::continueFunction):

Modules/indexeddb/legacy/IDBCursorBackend.h:
Modules/indexeddb/legacy/IDBCursorBackendOperations.h:

(WebCore::CursorIterationOperation::create):
(WebCore::CursorIterationOperation::CursorIterationOperation):

Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:

(WebCore::GetOperation::perform):
(WebCore::PutOperation::perform):

Modules/indexeddb/legacy/LegacyCursor.cpp:

(WebCore::LegacyCursor::continueFunction):

Modules/indexeddb/legacy/LegacyCursor.h:
Modules/indexeddb/legacy/LegacyFactory.h:

(WebCore::LegacyFactory::create):

Modules/indexeddb/legacy/LegacyRequest.cpp:

(WebCore::LegacyRequest::onSuccess):

Modules/indexeddb/legacy/LegacyRequest.h:
inspector/InspectorIndexedDBAgent.cpp:

11:36 PM Changeset in webkit [197314] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r197246 - Unreviewed. Fix GTK+ clean build.

Add missing header include.

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

11:35 PM Changeset in webkit [197313] by Carlos Garcia Campos

11 edits
3 adds in releases/WebKitGTK/webkit-2.12

Merge r197231 - Modern IDB: New database versions are never committed to SQLite.
<rdar://problem/24860952> and https://bugs.webkit.org/show_bug.cgi?id=154741

Modern IDB: If a database handle is not open, files are not actually deleted from disk
https://bugs.webkit.org/show_bug.cgi?id=154756

Reviewed by Alex Christensen.

Source/WebCore:

Tested by API test "IndexedDBPersistence"

Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::deleteDatabase): If there's not an open handle to the database, create one.

Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction): If a version change transaction, actually

set the new version on disk.

Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
(WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore): If there is no open backing store, create one.

This is necessary to both read the current database version, and to actually delete the file on disk.

(WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore): If necessary, manufacture a "most recently

deleted database info" from the version returned by deleteBackingStore.

Modules/indexeddb/server/UniqueIDBDatabase.h:

Source/WebKit2:

Add WK2 SPI to force termination of the database process.

UIProcess/API/Cocoa/WKProcessPool.mm:

(-[WKProcessPool _terminateDatabaseProcess]):

UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::terminateDatabaseProcess):

UIProcess/WebProcessPool.h:

Tools:

This also happens to test the previously untested fix for http://trac.webkit.org/changeset/197190

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence-1.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence-2.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence.mm: Added.

(-[IndexedDBNavigationDelegate webView:didFinishNavigation:]):
(-[IndexedDBMessageHandler userContentController:didReceiveScriptMessage:]):
(TEST):

11:35 PM Changeset in webkit [197312] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197190 - Modern IDB: Using existing database info from SQLite backing store is busted.
<rdar://problem/24848143> and https://bugs.webkit.org/show_bug.cgi?id=154735

Reviewed by Alex Christensen.

No new tests.

Reproducing the bug requires having a known database on disk *before* launching the DatabaseProcess to
read in the existing IDBDatabaseInfo.

Our automated infrastructure currently has no way of testing this.

Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::openDatabase):

Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo): Do the optional migrate on

the IndexRecords table here; *every* time we open a SQLite backing store.

(WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo): Deleted.

Modules/indexeddb/shared/IDBDatabaseInfo.cpp:

(WebCore::IDBDatabaseInfo::isolatedCopy): Copy the entire object, not just name/version.

11:35 PM Changeset in webkit [197311] by Carlos Garcia Campos

40 edits
71 deletes in releases/WebKitGTK/webkit-2.12/Source

Merge r197131 - Remove LegacyIDB.
https://bugs.webkit.org/show_bug.cgi?id=150854

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (No change in behavior).

CMakeLists.txt:
Modules/indexeddb/DOMWindowIndexedDatabase.cpp:

(WebCore::DOMWindowIndexedDatabase::indexedDB):

Modules/indexeddb/IDBDatabaseMetadata.cpp: Removed.
Modules/indexeddb/IDBDatabaseMetadata.h: Removed.
Modules/indexeddb/IDBFactory.h:
Modules/indexeddb/IDBIndex.h:
Modules/indexeddb/IDBIndexMetadata.h: Removed.
Modules/indexeddb/IDBObjectStoreMetadata.h: Removed.
Modules/indexeddb/IDBOperation.h: Removed.
Modules/indexeddb/IDBServerConnection.h: Removed.
Modules/indexeddb/IDBTransaction.h:
Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:

(WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):

Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:
Modules/indexeddb/legacy/IDBCallbacks.h: Removed.
Modules/indexeddb/legacy/IDBCursorBackend.cpp: Removed.
Modules/indexeddb/legacy/IDBCursorBackend.h: Removed.
Modules/indexeddb/legacy/IDBCursorBackendOperations.cpp: Removed.
Modules/indexeddb/legacy/IDBCursorBackendOperations.h: Removed.
Modules/indexeddb/legacy/IDBDatabaseBackend.cpp: Removed.
Modules/indexeddb/legacy/IDBDatabaseBackend.h: Removed.
Modules/indexeddb/legacy/IDBDatabaseCallbacks.h: Removed.
Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.cpp: Removed.
Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.h: Removed.
Modules/indexeddb/legacy/IDBFactoryBackendInterface.h: Removed.
Modules/indexeddb/legacy/IDBPendingDeleteCall.h: Removed.
Modules/indexeddb/legacy/IDBPendingOpenCall.h: Removed.
Modules/indexeddb/legacy/IDBPendingTransactionMonitor.cpp: Removed.
Modules/indexeddb/legacy/IDBPendingTransactionMonitor.h: Removed.
Modules/indexeddb/legacy/IDBTransactionBackend.cpp: Removed.
Modules/indexeddb/legacy/IDBTransactionBackend.h: Removed.
Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp: Removed.
Modules/indexeddb/legacy/IDBTransactionBackendOperations.h: Removed.
Modules/indexeddb/legacy/IDBTransactionCoordinator.cpp: Removed.
Modules/indexeddb/legacy/IDBTransactionCoordinator.h: Removed.
Modules/indexeddb/legacy/LegacyAny.cpp: Removed.
Modules/indexeddb/legacy/LegacyAny.h: Removed.
Modules/indexeddb/legacy/LegacyCursor.cpp: Removed.
Modules/indexeddb/legacy/LegacyCursor.h: Removed.
Modules/indexeddb/legacy/LegacyCursorWithValue.cpp: Removed.
Modules/indexeddb/legacy/LegacyCursorWithValue.h: Removed.
Modules/indexeddb/legacy/LegacyDatabase.cpp: Removed.
Modules/indexeddb/legacy/LegacyDatabase.h: Removed.
Modules/indexeddb/legacy/LegacyFactory.cpp: Removed.
Modules/indexeddb/legacy/LegacyFactory.h: Removed.
Modules/indexeddb/legacy/LegacyIndex.cpp: Removed.
Modules/indexeddb/legacy/LegacyIndex.h: Removed.
Modules/indexeddb/legacy/LegacyObjectStore.cpp: Removed.
Modules/indexeddb/legacy/LegacyObjectStore.h: Removed.
Modules/indexeddb/legacy/LegacyOpenDBRequest.cpp: Removed.
Modules/indexeddb/legacy/LegacyOpenDBRequest.h: Removed.
Modules/indexeddb/legacy/LegacyRequest.cpp: Removed.
Modules/indexeddb/legacy/LegacyRequest.h: Removed.
Modules/indexeddb/legacy/LegacyTransaction.cpp: Removed.
Modules/indexeddb/legacy/LegacyTransaction.h: Removed.
Modules/indexeddb/legacy/LegacyVersionChangeEvent.cpp: Removed.
Modules/indexeddb/legacy/LegacyVersionChangeEvent.h: Removed.
Modules/indexeddb/server/SQLiteIDBCursor.cpp:

(WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
(WebCore::IDBServer::SQLiteIDBCursor::establishStatement):
(WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):

Modules/indexeddb/server/SQLiteIDBCursor.h:
Modules/indexeddb/shared/IDBIndexInfo.h:
WebCore.xcodeproj/project.pbxproj:
bindings/js/IDBBindingUtilities.cpp:

(WebCore::generateIndexKeysForValue): Deleted.

bindings/js/IDBBindingUtilities.h:
bindings/js/JSMainThreadExecState.cpp:

(WebCore::JSMainThreadExecState::didLeaveScriptContext): Deleted.

inspector/InspectorIndexedDBAgent.cpp:
loader/EmptyClients.cpp:
page/DatabaseProvider.cpp:

(WebCore::DatabaseProvider::idbFactoryBackend): Deleted.

page/DatabaseProvider.h:
platform/CrossThreadCopier.cpp:

(WebCore::IDBDatabaseMetadata>::copy): Deleted.
(WebCore::IDBIndexMetadata>::copy): Deleted.
(WebCore::IDBObjectStoreMetadata>::copy): Deleted.

platform/CrossThreadCopier.h:

Source/WebKit:

Storage/WebDatabaseProvider.cpp:

(WebDatabaseProvider::createIDBFactoryBackend): Deleted.

Storage/WebDatabaseProvider.h:

Source/WebKit2:

CMakeLists.txt:
DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::getOrCreateLegacyUniqueIDBDatabase): Deleted.
(WebKit::DatabaseProcess::removeLegacyUniqueIDBDatabase): Deleted.

DatabaseProcess/DatabaseProcess.h:
DatabaseProcess/DatabaseToWebProcessConnection.cpp:

(WebKit::DatabaseToWebProcessConnection::didClose):
(WebKit::DatabaseToWebProcessConnection::didReceiveMessage): Deleted.
(WebKit::DatabaseToWebProcessConnection::didReceiveSyncMessage): Deleted.
(WebKit::DatabaseToWebProcessConnection::establishIDBConnection): Deleted.
(WebKit::DatabaseToWebProcessConnection::removeDatabaseProcessIDBConnection): Deleted.

DatabaseProcess/DatabaseToWebProcessConnection.h:
DatabaseProcess/DatabaseToWebProcessConnection.messages.in:
DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.cpp: Removed.
DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.h: Removed.
DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.messages.in: Removed.
DatabaseProcess/IndexedDB/IDBIdentifier.h: Removed.
DatabaseProcess/IndexedDB/IDBSerialization.cpp: Removed.
DatabaseProcess/IndexedDB/IDBSerialization.h: Removed.
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.cpp: Removed.
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.h: Removed.
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.cpp: Removed.
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.h: Removed.
DatabaseProcess/IndexedDB/UniqueIDBDatabaseBackingStore.h: Removed.
DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h:
DatabaseProcess/IndexedDB/sqlite/SQLiteIDBCursor.cpp: Removed.
DatabaseProcess/IndexedDB/sqlite/SQLiteIDBCursor.h: Removed.
DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.cpp: Removed.
DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.h: Removed.
DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp: Removed.
DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.h: Removed.
DerivedSources.make:
Shared/WebCrossThreadCopier.cpp:

(WebCore::LegacyUniqueIDBDatabaseIdentifier>::copy): Deleted.
(WebCore::IDBIdentifier>::copy): Deleted.

Shared/WebCrossThreadCopier.h:
WebKit2.xcodeproj/project.pbxproj:
WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.cpp: Removed.
WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.h: Removed.
WebProcess/Databases/IndexedDB/WebIDBServerConnection.cpp: Removed.
WebProcess/Databases/IndexedDB/WebIDBServerConnection.h: Removed.
WebProcess/Databases/IndexedDB/WebIDBServerConnection.messages.in: Removed.
WebProcess/Databases/WebDatabaseProvider.cpp:

(WebKit::WebDatabaseProvider::createIDBFactoryBackend): Deleted.

WebProcess/Databases/WebDatabaseProvider.h:
WebProcess/Databases/WebToDatabaseProcessConnection.cpp:

(WebKit::WebToDatabaseProcessConnection::didReceiveMessage): Deleted.
(WebKit::WebToDatabaseProcessConnection::registerWebIDBServerConnection): Deleted.
(WebKit::WebToDatabaseProcessConnection::removeWebIDBServerConnection): Deleted.

WebProcess/Databases/WebToDatabaseProcessConnection.h:
WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:

11:33 PM Changeset in webkit [197310] by Carlos Garcia Campos

10 edits
1 add
78 deletes in releases/WebKitGTK/webkit-2.12

Merge r197122 - Modern IDB: WebKit 2 IPC layer.
https://bugs.webkit.org/show_bug.cgi?id=153808

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (Covered by over 1,000 existing tests).

Modules/indexeddb/IDBKeyData.h:

(WebCore::IDBKeyData::encode): It's okay to encode Min and Max.
(WebCore::IDBKeyData::decode): It's okay to decode Min and Max.

Source/WebKit2:

NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad): This ASSERT fires on most WK2 tests. Alex said remove it.

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::putOrAdd): Properly encode the overwrite flag.

WebProcess/Databases/WebDatabaseProvider.h: Enable Modern IDB.

LayoutTests:

Consolidate all test failures to the platform agnostic TestExpectations file.
Remove all existing WK2-specific results.
Add one new WK2-specific result.
Skip two WK2-only failures.

TestExpectations:
platform/mac-wk1/TestExpectations:
platform/mac-wk2/TestExpectations:
platform/wk2/TestExpectations:
platform/wk2/imported/w3c/indexeddb/abort-in-initial-upgradeneeded-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor-advance-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_advance_index5-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_advance_index9-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_advance_objectstore5-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index5-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index6-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index8-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_invalid-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_objectstore6-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_delete_index4-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_delete_objectstore4-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbdatabase_close2-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbdatabase_deleteObjectStore4-not_reused-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbfactory_deleteDatabase3-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbfactory_open12-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex-multientry-big-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_get3-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_get7-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_getKey7-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_openCursor2-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_openKeyCursor3-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_add4-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex2-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex4-deleteIndex-event_order-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex6-event_order-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex7-event_order-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_put4-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbtransaction_abort-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbversionchangeevent-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/keygenerator-constrainterror-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/keygenerator-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/keygenerator-overflow-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/transaction-requestqueue-expected.txt: Removed.
platform/wk2/storage/indexeddb/aborted-versionchange-closes-expected.txt: Removed.
platform/wk2/storage/indexeddb/bad-keypath-expected.txt: Removed.
platform/wk2/storage/indexeddb/basics-expected.txt: Removed.
platform/wk2/storage/indexeddb/clear-expected.txt: Removed.
platform/wk2/storage/indexeddb/create-and-remove-object-store-expected.txt: Removed.
platform/wk2/storage/indexeddb/create-objectstore-basics-expected.txt: Removed.
platform/wk2/storage/indexeddb/cursor-continue-dir-expected.txt: Removed.
platform/wk2/storage/indexeddb/cursor-continue-expected.txt: Removed.
platform/wk2/storage/indexeddb/cursor-finished-expected.txt: Removed.
platform/wk2/storage/indexeddb/cursors-expected.txt: Removed.
platform/wk2/storage/indexeddb/database-basics-expected.txt: Removed.
platform/wk2/storage/indexeddb/deleteIndex-bug110792-expected.txt: Removed.
platform/wk2/storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt: Added.
platform/wk2/storage/indexeddb/index-count-expected.txt: Removed.
platform/wk2/storage/indexeddb/intversion-abort-in-initial-upgradeneeded-expected.txt: Removed.
platform/wk2/storage/indexeddb/intversion-close-in-oncomplete-expected.txt: Removed.
platform/wk2/storage/indexeddb/intversion-close-in-upgradeneeded-expected.txt: Removed.
platform/wk2/storage/indexeddb/invalid-keys-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-requirements-delete-null-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-requirements-inline-and-passed-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-requirements-put-no-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-requirements-put-null-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-type-array-expected.txt: Removed.
platform/wk2/storage/indexeddb/keypath-arrays-expected.txt: Removed.
platform/wk2/storage/indexeddb/keypath-edges-expected.txt: Removed.
platform/wk2/storage/indexeddb/keyrange-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/bad-keypath-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/clear-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/create-objectstore-basics-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/cursors-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/key-requirements-delete-null-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/key-requirements-inline-and-passed-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/key-requirements-put-no-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/key-requirements-put-null-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/readonly-transactions-expected.txt: Removed.
platform/wk2/storage/indexeddb/object-lookups-in-versionchange-expected.txt: Removed.
platform/wk2/storage/indexeddb/objectstore-count-expected.txt: Removed.
platform/wk2/storage/indexeddb/open-cursor-expected.txt: Removed.
platform/wk2/storage/indexeddb/readonly-transactions-expected.txt: Removed.
platform/wk2/storage/indexeddb/request-result-cache-expected.txt: Removed.
platform/wk2/storage/indexeddb/transaction-abort-expected.txt: Removed.
platform/wk2/storage/indexeddb/transaction-active-flag-expected.txt: Removed.
platform/wk2/storage/indexeddb/transaction-after-close-expected.txt: Removed.
platform/wk2/storage/indexeddb/transaction-read-only-expected.txt: Removed.
platform/wk2/storage/indexeddb/version-change-exclusive-expected.txt: Removed.

10:57 PM Changeset in webkit [197309] by Carlos Garcia Campos

22 edits
1 copy
1 add in releases/WebKitGTK/webkit-2.12

Merge r197118 - CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
https://bugs.webkit.org/show_bug.cgi?id=154522
<rdar://problem/24762078>

Reviewed by Brent Fulgham.

Source/WebCore:

Include attributes statusCode and columnNumber in a dispatched SecurityPolicyViolationEvent and
as part of the SecurityPolicyViolationEventInit dictionary as per section Violation DOM Events
of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp/> (24 February 2016).
Additionally, enable dispatching of this event when a Content Security Policy violation occurs regardless
of whether ENABLE(CSP_NEXT) is enabled.

Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.
dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.
dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this

code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent
to support attributes statusCode and columnNumebr.

dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.
page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent
and send a violation report (if applicable).

LayoutTests:

Add new test http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html
to ensure that SecurityPolicyViolationEvent.statusCode is 0 when dispatched for a violation on an HTTPS-served
document per section Reporting of the Content Security Policy 2.0 spec, <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.
Update existing test results and mark more tests as PASS in file LayoutTests/TestExpectations.

TestExpectations: Mark tests http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation*.html as PASS

so that we run them.

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt: Update expected result to

reflect failing sub-test. We do not support the experimental JavaScript event listener onsecuritypolicyviolation when
building with ENABLE(CSP_NEXT) disabled.

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Update line and column numbers.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt: Added.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html: Added.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html: Update line and column numbers.
js/dom/global-constructors-attributes-expected.txt: Update expected results now that we expose SecurityPolicyViolationEvent.
platform/efl/js/dom/global-constructors-attributes-expected.txt: Ditto.
platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt: Ditto.
platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt: Ditto.
platform/mac/js/dom/global-constructors-attributes-expected.txt: Ditto.

9:26 PM Changeset in webkit [197308] by akling@apple.com

7 edits in trunk/Source/JavaScriptCore

Make JSFunction.name allocation fully lazy.
<https://webkit.org/b/154806>

Reviewed by Saam Barati.

We were reifying the "name" field on functions lazily, but created the string
value itself up front. This patch gets rid of the up-front allocation,
saving us a JSString allocation per function in most cases.

builtins/BuiltinExecutables.cpp:

(JSC::createExecutableInternal):

bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::UnlinkedFunctionExecutable::visitChildren):

bytecode/UnlinkedFunctionExecutable.h:
runtime/CodeCache.cpp:

(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

runtime/Executable.h:
runtime/JSFunction.cpp:

(JSC::JSFunction::reifyName):

8:36 PM Changeset in webkit [197307] by Chris Dumez

4 edits in trunk

Parse HTMLOLElement.start as per the HTML spec
https://bugs.webkit.org/show_bug.cgi?id=154802

Reviewed by Andreas Kling.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/reflection-grouping-expected.txt:

Source/WebCore:

Parse HTMLOLElement.start as per the HTML spec:

No new tests, already covered by existing test.

html/HTMLOListElement.cpp:

(WebCore::HTMLOListElement::parseAttribute):

5:57 PM Changeset in webkit [197306] by Gyuyoung Kim

9 edits in trunk/Source/WebCore

Reduce uses of PassRefPtr in indexeddb
https://bugs.webkit.org/show_bug.cgi?id=154273

Reviewed by Darin Adler.

No new tests, no behavior changes.

Modules/indexeddb/IDBDatabaseError.h:

(WebCore::IDBDatabaseError::create):

Modules/indexeddb/IDBKeyData.cpp:

(WebCore::IDBKeyData::maybeCreateIDBKey):

Modules/indexeddb/IDBKeyData.h:
Modules/indexeddb/IDBKeyRange.cpp:

Modules/indexeddb/IDBKeyRange.h:

(WebCore::IDBKeyRange::create):
(WebCore::IDBKeyRange::lower):
(WebCore::IDBKeyRange::upper):
(WebCore::IDBKeyRange::lowerBound):
(WebCore::IDBKeyRange::upperBound):
(WebCore::IDBKeyRange::bound):

Modules/indexeddb/IDBKeyRangeData.cpp:

(WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange):

Modules/indexeddb/IDBKeyRangeData.h:
Modules/indexeddb/IDBServerConnection.h:
Modules/indexeddb/legacy/IDBCallbacks.h:
Modules/indexeddb/legacy/IDBCursorBackend.cpp:

(WebCore::IDBCursorBackend::continueFunction):

Modules/indexeddb/legacy/IDBCursorBackend.h:
Modules/indexeddb/legacy/IDBCursorBackendOperations.h:

(WebCore::CursorIterationOperation::create):
(WebCore::CursorIterationOperation::CursorIterationOperation):

Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:

(WebCore::GetOperation::perform):
(WebCore::PutOperation::perform):

Modules/indexeddb/legacy/LegacyCursor.cpp:

(WebCore::LegacyCursor::continueFunction):

Modules/indexeddb/legacy/LegacyCursor.h:
Modules/indexeddb/legacy/LegacyFactory.h:

(WebCore::LegacyFactory::create):

Modules/indexeddb/legacy/LegacyRequest.cpp:

(WebCore::LegacyRequest::onSuccess):

Modules/indexeddb/legacy/LegacyRequest.h:
inspector/InspectorIndexedDBAgent.cpp:

5:44 PM Changeset in webkit [197305] by akling@apple.com

2 edits in trunk/Source/JavaScriptCore

REGRESSION(r197303): 4 jsc tests failing on bots.

Unreviewed follow-up fix.

bytecode/UnlinkedCodeBlock.cpp:

4:32 PM Changeset in webkit [197304] by weinig@apple.com

24 edits
1 add
1 delete in trunk

Reimplement WKPageGroup in terms of WKUserContentController
https://bugs.webkit.org/show_bug.cgi?id=154804

Reviewed by Dan Bernstein.

Source/WebKit2:

Instead of having both WebPageGroup and WebUserContentControllerProxy both keep track
of user scripts and user stylesheets, give WebPageGroup a WebUserContentControllerProxy
and let it take care of things. This allows us to remove a ton of duplicate code, and
provides a convenient way for clients currently using PageGroup based user content insertion
to start using UserContentController, since they can now be used at the same time.

When using WKPageConfigurationRef, the rule is:

If you don't set a WKUserContentControllerRef, the one from the WKPageGroupRef will be used.
If you do set a WKUserContentControllerRef, it will be used, and the one from the WKPageGroupRef will do nothing for that web view.

DerivedSources.make:

Remove WebPageGroupProxy. It no longer is a MessageReceiver.

Shared/WebPageGroupData.cpp:

(WebKit::WebPageGroupData::encode):
(WebKit::WebPageGroupData::decode):

Shared/WebPageGroupData.h:

Stop encoding/decoding user content, instead just encode the identifier to the UserContentController.

UIProcess/API/C/WKPageGroup.cpp:

(WKPageGroupGetUserContentController):

UIProcess/API/C/WKPageGroup.h:

Add getter for the underlying WKUserContentControllerRef.

UIProcess/API/cpp/WKRetainPtr.h:

(WebKit::retainWK):
Add retainWK() helper to match RetainPtr's retainPtr() helper.

UIProcess/WebPageGroup.cpp:

(WebKit::WebPageGroup::WebPageGroup):
(WebKit::WebPageGroup::userContentController):
(WebKit::WebPageGroup::addUserStyleSheet):
(WebKit::WebPageGroup::addUserScript):
(WebKit::WebPageGroup::removeAllUserStyleSheets):
(WebKit::WebPageGroup::removeAllUserScripts):
(WebKit::WebPageGroup::removeAllUserContent):
(WebKit::WebPageGroup::addUserContentExtension):
(WebKit::WebPageGroup::removeUserContentExtension):
(WebKit::WebPageGroup::removeAllUserContentExtensions):

UIProcess/WebPageGroup.h:

Pass through to the WebUserContentControllerProxy.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::WebPageProxy):
(WebKit::WebPageProxy::finishInitializingWebPageAfterProcessLaunch):
(WebKit::WebPageProxy::creationParameters):

UIProcess/WebPageProxy.h:

WebPageProxies always have a WebUserContentControllerProxy now, so it can go in a Ref and
a few branches can be removed.

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::createWebPage):
If a UserContentController is not passed in, use the one from the PageGroup.

WebKit2.xcodeproj/project.pbxproj:

Remove files.

WebProcess/InjectedBundle/InjectedBundle.cpp:

Add some #includes that are now needed.

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::getOrCreate):

WebProcess/UserContent/WebUserContentController.h:

Modernize WebUserContentController::getOrCreate to return a Ref.

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::WebPage):
(WebKit::m_shouldDispatchFakeMouseMoveEvents):
(WebKit::WebPage::addUserScript):
(WebKit::WebPage::addUserStyleSheet):
(WebKit::WebPage::removeAllUserContent):

WebProcess/WebPage/WebPage.h:

Store the WebUserContentController in Ref, remove unnecessary branches/asserts.

WebProcess/WebPage/WebPageGroupProxy.cpp:

(WebKit::WebPageGroupProxy::WebPageGroupProxy):
(WebKit::WebPageGroupProxy::~WebPageGroupProxy):
(WebKit::WebPageGroupProxy::userContentController):
(WebKit::WebPageGroupProxy::addUserStyleSheet): Deleted.
(WebKit::WebPageGroupProxy::addUserScript): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserStyleSheets): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserScripts): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserContent): Deleted.
(WebKit::WebPageGroupProxy::addUserContentExtension): Deleted.
(WebKit::WebPageGroupProxy::removeUserContentExtension): Deleted.
(WebKit::WebPageGroupProxy::removeAllUserContentExtensions): Deleted.

WebProcess/WebPage/WebPageGroupProxy.h:

Store a WebUserContentController in a Ref, remove now unnecessary message handling functions.

WebProcess/WebPage/WebPageGroupProxy.messages.in:

Removed.

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::didReceiveMessage):
Remove routing to WebPageGroupProxy, which is no longer a MessageReceiver.

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2/PageGroup.cpp: Added.

2:21 PM Changeset in webkit [197303] by akling@apple.com

3 edits in trunk/Source/JavaScriptCore

Shrink UnlinkedCodeBlock a bit.
<https://webkit.org/b/154797>

Reviewed by Anders Carlsson.

The VM member was removed entirely since UnlinkedCodeBlock is a cell
and can retrieve its VM through MarkedBlock header lookup.

bytecode/UnlinkedCodeBlock.cpp:

bytecode/UnlinkedCodeBlock.h:

1:56 PM Changeset in webkit [197302] by weinig@apple.com

17 edits in trunk

Source/WebKit2:
Bind _WKUserStyleSheets to _WKUserContentWorlds to allow for grouping of user content by associating to a world
https://bugs.webkit.org/show_bug.cgi?id=154798

Reviewed by Dan Bernstein.

Treat _WKUserStyleSheets like WKUserScripts and allow them to be bound to a _WKUserContentWorld.
The immediate benefit of this is allowing a client to bind a set of user content (scripts and stylesheets
for now) to a world and have them easily remove all user content associated with that world easily.

Shared/API/APIArray.h:

Add helpers removeAllMatching and removeAllOfTypeMatching.

UIProcess/API/APIUserStyleSheet.h:

Add API::UserContentWorld member.

UIProcess/API/Cocoa/WKUserContentController.mm:

(-[WKUserContentController _removeAllUserScriptsAssociatedWithUserContentWorld:]):
(-[WKUserContentController _removeAllUserStyleSheetsAssociatedWithUserContentWorld:]):

UIProcess/API/Cocoa/WKUserContentControllerPrivate.h:

Add _removeAllUserScriptsAssociatedWithUserContentWorld and _removeAllUserStyleSheetsAssociatedWithUserContentWorld.

UIProcess/API/Cocoa/WKUserScript.mm:

(-[WKUserScript _initWithSource:injectionTime:forMainFrameOnly:legacyWhitelist:legacyBlacklist:userContentWorld:]):
(toStringVector): Deleted.

UIProcess/API/Cocoa/_WKUserContentWorldInternal.h:

(API::toStringVector):
Move toStringVector to a location where it can be shared.

UIProcess/API/Cocoa/_WKUserStyleSheet.h:
UIProcess/API/Cocoa/_WKUserStyleSheet.mm:

(-[_WKUserStyleSheet initWithSource:forMainFrameOnly:legacyWhitelist:legacyBlacklist:userContentWorld:]):
Add new initializer which has a world to be bound to. While here, match WKUserScript and add support for the
legacy whitelist and blacklists.

UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::addProcess):
(WebKit::WebUserContentControllerProxy::removeProcess):
(WebKit::WebUserContentControllerProxy::addUserContentWorldUse):
(WebKit::WebUserContentControllerProxy::shouldSendRemoveUserContentWorldsMessage):
(WebKit::WebUserContentControllerProxy::removeUserContentWorldUses):
(WebKit::WebUserContentControllerProxy::addUserScript):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::removeAllUserScripts):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeAllUserStyleSheets):

UIProcess/UserContent/WebUserContentControllerProxy.h:

Refactor to share the code which decides whether to send AddUserContentWorlds/RemoveUserContentWorlds
messages.

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::addUserContentWorlds):
(WebKit::WebUserContentController::removeUserContentWorlds):
(WebKit::WebUserContentController::addUserScripts):
(WebKit::WebUserContentController::removeUserScript):
(WebKit::WebUserContentController::removeAllUserScripts):
(WebKit::WebUserContentController::addUserStyleSheets):
(WebKit::WebUserContentController::removeUserStyleSheet):
(WebKit::WebUserContentController::removeAllUserStyleSheets):

WebProcess/UserContent/WebUserContentController.h:
WebProcess/UserContent/WebUserContentController.messages.in:

Add support for binding stylesheets to worlds and allow removing all the scripts/stylesheets from a
set of worlds at once by passing Vectors of world identifiers in the remove messages.

Tools:
Bind _WKUserStyleSheets to WKUserContentWorlds to allow for grouping of user content by associating to a world
https://bugs.webkit.org/show_bug.cgi?id=154798

Reviewed by Dan Bernstein.

TestWebKitAPI/Tests/WebKit2Cocoa/UserContentController.mm:

Add tests for removing _WKUserStyleSheets and WKUserScripts

1:00 PM Changeset in webkit [197301] by timothy_horton@apple.com

5 edits in trunk

Switch to application/vnd.apple.folder for <attachment> folder special-case
https://bugs.webkit.org/show_bug.cgi?id=154786
<rdar://problem/24416632>

Reviewed by Anders Carlsson.

Source/WebCore:

No new tests, adjusted an existing test to cover this.

rendering/RenderThemeMac.mm:

(WebCore::iconForAttachment):
Add a second folder MIME type.

LayoutTests:

fast/attachment/attachment-folder-icon-expected.html:
fast/attachment/attachment-folder-icon.html:

12:42 PM Changeset in webkit [197300] by timothy_horton@apple.com

3 edits
2 adds in trunk

Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
https://bugs.webkit.org/show_bug.cgi?id=154785

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/css/variables/avoid-matched-property-cache.html

css/StyleResolver.cpp:

LayoutTests:

fast/css/variables/avoid-matched-property-cache-expected.html: Added.
fast/css/variables/avoid-matched-property-cache.html: Added.

12:34 PM Changeset in webkit [197299] by fpizlo@apple.com

10 edits in trunk/Source/JavaScriptCore

FTL should lower its abstract heaps to B3 heap ranges
https://bugs.webkit.org/show_bug.cgi?id=154782

Reviewed by Saam Barati.

This peculiar scheme was a deliberate attempt to distill what the abstract heap
hierarchy is all about. We can assign begin...end numbers to abstract heaps so that:

A heap's end is greater than its begin.
A heap's begin is greater than or equal to its parent's begin.
A heap's end is less than or equal to its parent's end.

Even without a speed-up, this patch is valuable because it makes it easier to implement
other optimizations, like store elimination.

b3/B3HeapRange.h:

(JSC::B3::HeapRange::HeapRange):

ftl/FTLAbstractHeap.cpp:

ftl/FTLAbstractHeap.h:

ftl/FTLAbstractHeapRepository.cpp:

ftl/FTLAbstractHeapRepository.h:

(JSC::FTL::AbstractHeapRepository::forArrayType):
(JSC::FTL::AbstractHeapRepository::HeapForValue::HeapForValue):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

ftl/FTLOutput.cpp:

ftl/FTLOutput.h:

ftl/FTLTypedPointer.h:

(JSC::FTL::TypedPointer::operator!):
(JSC::FTL::TypedPointer::heap):
(JSC::FTL::TypedPointer::value):

12:12 PM Changeset in webkit [197298] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

SVGToOTFFontConversion.cpp does not compile with libstdc++ 4.8
https://bugs.webkit.org/show_bug.cgi?id=154794

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.

No new tests needed.

svg/SVGToOTFFontConversion.cpp:

(WebCore::SVGToOTFFontConverter::appendLigatureSubtable): Added const
qualifiers.

12:11 PM Changeset in webkit [197297] by commit-queue@webkit.org

2 edits in trunk

[cmake] Allow using FindGLIB in case glib is optional dependency.
https://bugs.webkit.org/show_bug.cgi?id=154796

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.

FindGLIB caused internal CMake error in case GLIBCONFIG_INCLUDE_DIR is
not defined.

Source/cmake/FindGLIB.cmake:

11:14 AM Changeset in webkit [197296] by gskachkov@gmail.com

18 edits
10 adds in trunk

[ES6] Arrow function syntax. Emit loading&putting this/super only if they are used in arrow function. https://bugs.webkit.org/show_bug.cgi?id=153981

Small improvements

10:40 AM Changeset in webkit [197295] by sbarati@apple.com

7 edits in trunk/Source/JavaScriptCore

ProxyObject.GetOwnProperty is partially broken because it doesn't propagate information back to the slot
https://bugs.webkit.org/show_bug.cgi?id=154768

Reviewed by Ryosuke Niwa.

This fixes a big bug with ProxyObject.GetOwnProperty:
http://www.ecma-international.org/ecma-262/6.0/index.html#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p
We weren't correctly propagating the result of this operation to the
out PropertySlot& parameter. This patch fixes that and adds tests.

runtime/ObjectConstructor.cpp:

(JSC::objectConstructorGetOwnPropertyDescriptor):
I added a missing exception check after object allocation
because I saw that it was missing while reading the code.

runtime/PropertyDescriptor.cpp:

(JSC::PropertyDescriptor::setUndefined):
(JSC::PropertyDescriptor::slowGetterSetter):
(JSC::PropertyDescriptor::getter):

runtime/PropertyDescriptor.h:

(JSC::PropertyDescriptor::attributes):
(JSC::PropertyDescriptor::value):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::performInternalMethodGetOwnProperty):

tests/es6.yaml:
tests/stress/proxy-get-own-property.js:

(let.handler.getOwnPropertyDescriptor):
(set get let.handler.return):
(set get let.handler.getOwnPropertyDescriptor):
(set get let):
(set get let.a):
(let.b):
(let.setter):
(let.getter):

6:57 AM Changeset in webkit [197294] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r179776 - ASSERT repaintContainer->hasLayer() in WebCore::RenderObject::repaintUsingContainer
https://bugs.webkit.org/show_bug.cgi?id=140750

Reviewed by Simon Fraser.

There's a short period of time when RenderObject::layer() still returns a valid pointer
even though we already cleared the hasLayer() flag.
Do not use the layer as repaint container in such cases.

Source/WebCore:

Test: compositing/repaint-container-assertion-when-toggling-compositing.html

rendering/RenderObject.cpp:

(WebCore::RenderObject::enclosingLayer):

LayoutTests:

compositing/repaint-container-assertion-when-toggling-compositing-expected.txt: Added.
compositing/repaint-container-assertion-when-toggling-compositing.html: Added.

6:56 AM Changeset in webkit [197293] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r178363 - Element::normalizeAttributes() needs to handle arbitrary JS executing between loop iterations.
<https://webkit.org/b/140379>
<rdar://problem/19446901>

Reviewed by Benjamin Poulain.

Source/WebCore:

Since DOM mutation events may arise below the call to Node::normalize(),
have the loop in Element::normalizeAttributes() make a copy of the Attr nodes
beforehand, to guard against mutations.

Based on a patch by Chris "Chris Dumez" Dumez.

Test: fast/dom/Element/normalize-crash2.html

dom/Element.cpp:

(WebCore::Element::normalizeAttributes):

LayoutTests:

fast/dom/Element/normalize-crash2-expected.txt: Added.
fast/dom/Element/normalize-crash2.html: Added.

6:46 AM Changeset in webkit [197292] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/JavaScriptCore

Merge r178311 - Out of bounds read in IdentifierArena::makeIdentifier
https://bugs.webkit.org/show_bug.cgi?id=140376

Patch by Alexey Proskuryakov.

Reviewed and ChangeLogged by Geoffrey Garen.

No test, since this is a small past-the-end read, which is very
difficult to turn into a reproducible failing test -- and existing tests
crash reliably using ASan.

parser/ParserArena.h:

(JSC::IdentifierArena::makeIdentifier):
(JSC::IdentifierArena::makeIdentifierLCharFromUChar): Check for a
zero-length string input, like we do in the literal parser, since it is
not valid to dereference characters in a zero-length string.

A zero-length string is allowed in JavaScript -- for example, "".

6:34 AM Changeset in webkit [197291] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r179750 - REGRESSION(r179706): Caused memory corruption on some tests (Requested by _ap_ on #webkit).
https://bugs.webkit.org/show_bug.cgi?id=141324

Reviewed by Alexey Proskuryakov.

No new tests. This is caught by existing tests under ASAN, and I don't know how to reproduce
it without ASAN.

rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Give up
and just always invalidate the next line. It's too hard to come up
with the condition that catches all needed cases, doesn't itself
cause a crash, and isn't overzealous. And we do this for the
previous line anyway. Also clean up the code a bit since it
confusingly reuses a variable, and declares it uninitialized, for
no good reason.

6:34 AM Changeset in webkit [197290] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r179706 - Crash due to failing to dirty a removed text node's line box
https://bugs.webkit.org/show_bug.cgi?id=136544

Reviewed by David Hyatt.
Source/WebCore:

Test: fast/text/remove-text-node-linebox-not-dirty-crash.html

rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Make the check for dirtying the next
line box a bit more inclusive to avoid a case of a line box for a destroyed render object not
being dirtied. In particular, when the text node's parent has no line boxes but contains BRs.

LayoutTests:

fast/text/remove-text-node-linebox-not-dirty-crash-expected.txt: Added.
fast/text/remove-text-node-linebox-not-dirty-crash.html: Added.

6:23 AM Changeset in webkit [197289] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.4

Merge r180128 - Crash when accessing an item in SVGLengthList and then replacing it with a previous item in the list.
https://bugs.webkit.org/show_bug.cgi?id=141552.

Reviewed by Darin Adler.

Source/WebCore:

Tests: LayoutTests/svg/dom/SVGLengthList-basics.xhtml: This test is modified to
include a new test case.

svg/properties/SVGListPropertyTearOff.h: Commit the removal of the replacing item

before trying to detach the wrapper of the item which going to be replaced.

LayoutTests:

svg/dom/SVGLengthList-basics-expected.txt:
svg/dom/SVGLengthList-basics.xhtml: Add a new test case to this test. Have a

reference to an SVGLength in an SVGLengthList and then replace this SVGLength
with another one which comes before it in the SVGLengthList.

6:01 AM Changeset in webkit [197288] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.4

Merge r182284 - Clean up access checks in JSHistoryCustom.cpp
https://bugs.webkit.org/show_bug.cgi?id=143227

Reviewed by Sam Weinig.

Source/WebCore:

bindings/js/JSHistoryCustom.cpp:

(WebCore::JSHistory::putDelegate):
(WebCore::JSHistory::deleteProperty):
(WebCore::JSHistory::deletePropertyByIndex):
(WebCore::JSHistory::getOwnPropertyNames):
(WebCore::JSHistory::pushState):
(WebCore::JSHistory::replaceState):

LayoutTests:

http/tests/security/cross-frame-access-call-expected.txt:
http/tests/security/cross-frame-access-call.html:

6:00 AM Changeset in webkit [197287] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r173046 - Scrollbar corner can be drawn outside containing frame
https://bugs.webkit.org/show_bug.cgi?id=133131
<rdar://problem/16382769>

Reviewed by Simon Fraser.

Source/WebCore:

Merged from Blink (patch by Levi Weintraub):
<https://src.chromium.org/viewvc/blink?revision=170625&view=revision>

Fixes an issue where the scroll corner may be painted outside the rectangle of
its associated frame by setting a clip rectangle before painting the scroll bar(s)
and scroll corner.

Test: scrollbars/custom-scrollbars-paint-outside-iframe.html

platform/ScrollView.cpp:

(WebCore::ScrollView::paint):

LayoutTests:

Add DRT test that was derived from the test included in
<https://src.chromium.org/viewvc/blink?revision=170625&view=revision>.

scrollbars/custom-scrollbars-paint-outside-iframe-expected.html: Added.
scrollbars/custom-scrollbars-paint-outside-iframe.html: Added.

5:50 AM Changeset in webkit [197286] by Carlos Garcia Campos

5 edits
12 adds in releases/WebKitGTK/webkit-2.4

Merge r186663 - Fetching Content Security Policy report URL should respect same origin policy
https://bugs.webkit.org/show_bug.cgi?id=146754
<rdar://problem/18860259>

Reviewed by Brady Eidson.

Inspired by Blink r149791 (by Mike West <mkwst@chromium.org>):
<https://src.chromium.org/viewvc/blink?revision=149791&view=revision>

Source/WebCore:

As per <http://www.w3.org/TR/2015/CR-CSP2-20150219/#send-violation-reports>, fetching the
Content Security Policy report URL should include cookies if and only if the origin of
the protected resource is equal to the origin of the report URL.

Tests: http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.html

http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.html
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.html
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.html
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.html
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.html

loader/PingLoader.cpp:

(WebCore::PingLoader::sendViolationReport):

LayoutTests:

Added additional tests for private browsing mode.

http/tests/cookies/resources/setCookies.cgi:
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.html: Added.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.html: Added.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.html: Added.
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.html: Added.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.html: Added.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.html: Added.
http/tests/security/contentSecurityPolicy/resources/save-report.php:
platform/wk2/TestExpectations: Skip private browsing mode tests in WebKit2 until we fix <https://bugs.webkit.org/show_bug.cgi?id=115274>.

5:44 AM Changeset in webkit [197285] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r186666 - Plugin create can end up destroying its renderer.
https://bugs.webkit.org/show_bug.cgi?id=146824
rdar://problem/18921429

Reviewed by Andreas Kling.

Plugins can run arbitrary code during initialization. If the plugin
happens to destroy the associated node, its renderer becomes invalid.
This patch checks whether the renderer survived the createPlugin() call.
(This WeakPtr pattern is also used in RenderWidget to avoid dangling pointers.)

Speculative fix. Not reproducible.

loader/SubframeLoader.cpp:

(WebCore::SubframeLoader::loadPlugin):

5:42 AM Changeset in webkit [197284] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r188014 - Crash when removing children of a MathMLSelectElement
https://bugs.webkit.org/show_bug.cgi?id=147704
<rdar://problem/21940321>

Reviewed by Ryosuke Niwa.

Source/WebCore:

When MathMLSelectElement::childrenChanged() is called after its
children have been removed, MathMLSelectElement calls
updateSelectedChild() which accesses m_selectedChild. However,
in this case, m_selectedChild is the previously selected child
and it may be destroyed as this point if it was removed. To avoid
this problem, MathMLSelectElement now keep a strong ref to the
currently selected element.

Test: mathml/maction-removeChild.html

mathml/MathMLSelectElement.h:

LayoutTests:

Add layout test that reproduces the crash under guardmalloc.

mathml/maction-removeChild-expected.txt: Added.
mathml/maction-removeChild.html: Added.

5:29 AM Changeset in webkit [197283] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r184965 - Crash under ICU with ASAN during editing/selection/move-by-word-visually-crash-test-5.html
https://bugs.webkit.org/show_bug.cgi?id=145429
<rdar://problem/20992218>

Reviewed by Alexey Proskuryakov.

WebKit uses some strings which contain the lower 8-bits of UTF-16 (thereby saving space). However,
ICU doesn't understand this encoding. When we want to use ICU functions with strings in this encoding,
we create a UTextProvider which converts our encoded strings to UTF-16 for ICU, one chunk at a time.
This object contains a vtable which we populate to perform the conversion.

The WebKit function which actually returns the UTF-16 chunks has two relevant arguments: an index into
the encoded string which ICU is requesting, and a direction from that index which ICU is interested
in. This function populates a "chunk" which is characterized by a pointer to a buffer, the length of
the populated data in the buffer, and an offset into the chunk which represents the index that the
requested character was put into.

When ICU requests data going backward, we fill in the chunk accordingly, with the requested character
all the way at the end. We then set the offset equal to the length of the buffer. However, this length
value is stale from the previous time the function ran. Therefore, ICU was reading the wrong index in
the chunk when expecting the requested character.

Covered by editing/selection/move-by-word-visually-crash-test-5.html.

platform/text/icu/UTextProviderLatin1.cpp:

(WebCore::uTextLatin1Access):

5:27 AM Changeset in webkit [197282] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r185003 - WebSQL default functions can bypass authorizer.
<rdar://problem/21048994> and https://bugs.webkit.org/show_bug.cgi?id=145463

Reviewed by Sam Weinig and Alexey Proskuryakov.

No new tests yet.

platform/sql/SQLiteDatabase.cpp:

(WebCore::unauthorizedSQLFunction): Function to install into SQLite to override some built-in functions.
(WebCore::SQLiteDatabase::open):
(WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): Install function overrides for functions that

take arbitrary input that are also meant to be disabled by virtue of them not being whitelisted.

platform/sql/SQLiteDatabase.h:

Review feedback followup for r185003.
https://bugs.webkit.org/show_bug.cgi?id=145463

Reviewed by Darin Adler.

platform/sql/SQLiteDatabase.cpp:

(WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): static const one thing, c++-style cast another.

5:23 AM Changeset in webkit [197281] by Carlos Garcia Campos

6 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r185392 - feComposite filter does not clip the paint rect to its effect rect when the operator is 'in' or 'atop'
https://bugs.webkit.org/show_bug.cgi?id=137856

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2015-06-09
Reviewed by Darin Adler.

Source/WebCore:

There was bug in calculating the absolutePaintRect of the feComposite filter
when the operator is equal to 'in' or 'atop'. The absolutePaintRect was set
to the absolutePaintRect of the background FilterEffect which is correct.
What was missing is clipping this rectangle to the maxEffectRect of the
filter which we do for other operators.

Tests: svg/filters/feComposite-background-rect-control-operators.svg

platform/graphics/IntRect.h:

(WebCore::operator-=):
(WebCore::operator-): Add new operators to IntRect.

platform/graphics/filters/FEComposite.cpp:

(WebCore::FEComposite::determineAbsolutePaintRect): Make sure the filter
absolutePaintRect is clipped to maxEffectRect for all operators.

(WebCore::FEComposite::platformApplySoftware): Code clean-up.

platform/graphics/filters/FilterEffect.cpp:

(WebCore::FilterEffect::determineAbsolutePaintRect): Move the clipping
part to a separate function.

(WebCore::FilterEffect::clipAbsolutePaintRect): Clip the absolutePaintRect
to the maxEffectRect of the filter.

platform/graphics/filters/FilterEffect.h:

LayoutTests:

svg/filters/feComposite-background-rect-control-operators-expected.svg: Added.
svg/filters/feComposite-background-rect-control-operators.svg: Added.

Ensure the painting rect of the feComposite filter with operator 'in' or
'atop' is clipped to its bounding rectangle

4:47 AM Changeset in webkit [197280] by Carlos Garcia Campos

4 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r185572 - RootInlineBox::m_lineBreakObj becomes invalid when a child renderer is removed and the line does not get marked dirty.
https://bugs.webkit.org/show_bug.cgi?id=145988
rdar://problem/20959137

Reviewed by David Hyatt.

This patch ensures that we find the right first inline box so that we can dirty the
the appropriate line boxes.
With marking the right line boxes dirty, now we can update RootInlineBox::m_lineBreakObj at the next layout.

Source/WebCore:

Test: fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html

rendering/RenderInline.cpp:

(WebCore::RenderInline::culledInlineFirstLineBox):
(WebCore::RenderInline::culledInlineLastLineBox):

rendering/RootInlineBox.cpp:

(WebCore::RootInlineBox::setLineBreakInfo): Deleted. Remove misleading assert and comment.

LayoutTests:

fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt: Added.
fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html: Added.

4:34 AM Changeset in webkit [197279] by Carlos Garcia Campos

8 edits
8 adds in releases/WebKitGTK/webkit-2.4

Merge r185769 - Various assertion failures occur when executing script in the midst of DOM insertion
https://bugs.webkit.org/show_bug.cgi?id=132482

Reviewed by Darin Adler.

Source/WebCore:

Prior to this change, when an element containing a <script> child was inserted into a document, the script was
executed in ScriptElement::insertedInto(). That script can access nodes that follow it in the newly-inserted
hierarchy but are not yet fully inserted, leading to at least the following problems:

The script could remove a node that is not yet marked as in the document.
The script could remove a named <map> that has yet to be added to TreeScope::m_imageMapsByName.
The script could remove a form control that has yet to be added to FormController::m_formElementsWithState.

These scenarios all result in assertion failures. This change ensures that each node in the newly-inserted
hierarchy is fully inserted before executing any scripts.

Tests: fast/dom/element-removed-while-inserting-parent-crash.html

fast/dom/named-map-removed-while-inserting-parent-crash.html
fast/forms/form-control-removed-while-inserting-parent-crash.html
svg/dom/element-removed-while-inserting-parent-crash.html

dom/ScriptElement.cpp:

(WebCore::ScriptElement::shouldNotifySubtreeInsertions): Renamed from insertedInto().
Returned true in the case where insertedInto() would've called prepareScript().
(WebCore::ScriptElement::didNotifySubtreeInsertions): Called prepareScript().
(WebCore::ScriptElement::insertedInto): Renamed to shouldNotifySubtreeInsertions().

dom/ScriptElement.h:
html/HTMLScriptElement.cpp:

(WebCore::HTMLScriptElement::insertedInto): If shouldNotifySubtreeInsertions() is true, returned InsertionShouldCallDidNotifySubtreeInsertions.
Otherwise, returned InsertionDone.
(WebCore::HTMLScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().

html/HTMLScriptElement.h:
svg/SVGScriptElement.cpp:

(WebCore::SVGScriptElement::insertedInto): Did the same as HTMLScriptElement::insertedInto().
(WebCore::SVGScriptElement::didNotifySubtreeInsertions): Called ScriptElement::didNotifySubtreeInsertions().

svg/SVGScriptElement.h:

LayoutTests:

Wrote named-map-removed-while-inserting-parent-crash.html by reducing the test case attached to bug 132482.
The remaining tests were taken from blink r132482.

fast/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
fast/dom/element-removed-while-inserting-parent-crash.html: Added.
fast/dom/named-map-removed-while-inserting-parent-crash-expected.txt: Added.
fast/dom/named-map-removed-while-inserting-parent-crash.html: Added.
fast/forms/form-control-removed-while-inserting-parent-crash-expected.txt: Added.
fast/forms/form-control-removed-while-inserting-parent-crash.html: Added.
svg/dom/element-removed-while-inserting-parent-crash-expected.txt: Added.
svg/dom/element-removed-while-inserting-parent-crash.html: Added.

3:55 AM Changeset in webkit [197278] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r182918 - Media element can manipulate DOM during Document destruction.
rdar://problem/20553898 and https://bugs.webkit.org/show_bug.cgi?id=143780

Patch by Brady Eidson <beidson@apple.com> on 2015-04-16
Reviewed by Jer Noble.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::configureMediaControls): Bail if the element has no active document.

3:48 AM Changeset in webkit [197277] by Carlos Garcia Campos

3 edits
3 adds in releases/WebKitGTK/webkit-2.4

Merge r183275 - Made Object.prototype.proto native getter and setter check that this object not null or undefined
https://bugs.webkit.org/show_bug.cgi?id=141865
rdar://problem/19927273

Reviewed by Filip Pizlo.

runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoGetter):
(JSC::globalFuncProtoSetter):

LayoutTests:
Added tests to ensure that Object.prototype.proto native getter and setter do not coerce undefined to this
https://bugs.webkit.org/show_bug.cgi?id=141865
rdar://problem/19927273

Reviewed by Filip Pizlo.

js/script-tests/sloppy-getter-setter-global-object.js: Added.
js/sloppy-getter-setter-global-object-expected.txt: Added.
js/sloppy-getter-setter-global-object.html: Added.

3:45 AM Changeset in webkit [197276] by Carlos Garcia Campos

5 edits
9 adds in releases/WebKitGTK/webkit-2.4

Merge r183280,r183672 - Origin header is preserved on cross-origin redirects.
https://bugs.webkit.org/show_bug.cgi?id=144157.

Reviewed by Sam Weinig.

Source/WebCore:

Tests: http/tests/security/cors-post-redirect-301.html

http/tests/security/cors-post-redirect-302.html
http/tests/security/cors-post-redirect-307.html
http/tests/security/cors-post-redirect-308.html

platform/network/cf/ResourceHandleCFNet.cpp:

(WebCore::ResourceHandle::willSendRequest): Always clear any origin header for cross-origin redirects.

platform/network/mac/ResourceHandleMac.mm:

(WebCore::ResourceHandle::willSendRequest): Ditto.

LayoutTests:

http/tests/security/cors-post-redirect-301-expected.txt: Added.
http/tests/security/cors-post-redirect-301.html: Added.
http/tests/security/cors-post-redirect-302-expected.txt: Added.
http/tests/security/cors-post-redirect-302.html: Added.
http/tests/security/cors-post-redirect-307-expected.txt: Added.
http/tests/security/cors-post-redirect-307.html: Added.
http/tests/security/cors-post-redirect-308-expected.txt: Added.
http/tests/security/cors-post-redirect-308.html: Added.
http/tests/security/resources/cors-post-redirect-target.php: Added.

[GTK] New CORS tests from r183280 fail on WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=144469

Reviewed by Sergio Villar Senin.

No new tests. This causes failing tests to pass.

platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::doRedirect): Clear the origin header on cross-origin redirects.

3:43 AM Changeset in webkit [197275] by Carlos Garcia Campos

6 edits
4 adds in releases/WebKitGTK/webkit-2.4

Merge r183436 - Form control may be associated with the wrong HTML Form element after form id change
https://bugs.webkit.org/show_bug.cgi?id=133456
<rdar://problem/17095055>

Reviewed by Andy Estes.

Source/WebCore:

Fixes an issue where a form control may be associated with the wrong HTML Form element
after the id of the HTML Form element associated with the form control is changed when
there is more than one HTML Form element with the same id in the document. Specifically,
a form control that has an HTML form attribute value X will always be associated with
some HTML Form element f where f.id = X regardless of whether f.id is subsequently
changed.

Tests: fast/forms/change-form-id-to-be-unique-then-submit-form.html

fast/forms/change-form-id-to-be-unique.html

dom/Element.cpp:

(WebCore::Element::attributeChanged): Notify observers when the id of an element changed.
(WebCore::Element::updateId): Added parameter NotifyObservers (defaults to NotifyObservers::Yes),
as to whether we should notify observers of the id change.
(WebCore::Element::updateIdForTreeScope): Ditto.
(WebCore::Element::willModifyAttribute): Do not notify observers of the id change immediately. As
indicated by the name of this method, we plan to modify the DOM attribute id of the element, but
we have not actually modified it when this method is called. Instead we will notify observers
in Element::attributeChanged(), which is called after the DOM attribute id is modified.
(WebCore::Element::cloneAttributesFromElement): Ditto.

dom/Element.h: Defined enum class NotifyObservers.
dom/TreeScope.cpp:

(WebCore::TreeScope::addElementById): Added boolean parameter notifyObservers (defaults to true)
as to whether we should dispatch a notification to all observers.
(WebCore::TreeScope::removeElementById): Ditto.

dom/TreeScope.h:

LayoutTests:

Add tests to ensure that we associate the correct HTML Form element with a
<select> after changing the id of its associated HTML form element.

fast/forms/change-form-id-to-be-unique-expected.txt: Added.
fast/forms/change-form-id-to-be-unique-then-submit-form-expected.txt: Added.
fast/forms/change-form-id-to-be-unique-then-submit-form.html: Added.
fast/forms/change-form-id-to-be-unique.html: Added.

3:42 AM Changeset in webkit [197274] by Carlos Garcia Campos

13 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Element::attributeChanged shouldn't do any work when attribute value didn't change
https://bugs.webkit.org/show_bug.cgi?id=129467

Reviewed by Geoffrey Garen.

Exit early in childrenChanged when the attribute value didn't change.

dom/Attr.cpp:

(WebCore::Attr::setValue):
(WebCore::Attr::childrenChanged):

dom/Element.cpp:

(WebCore::Element::setAttributeInternal):
(WebCore::Element::attributeChanged):
(WebCore::Element::parserSetAttributes):
(WebCore::Element::removeAttributeInternal):
(WebCore::Element::didAddAttribute):
(WebCore::Element::didModifyAttribute):
(WebCore::Element::didRemoveAttribute):
(WebCore::Element::cloneAttributesFromElement):

dom/Element.h:
dom/StyledElement.cpp:

(WebCore::StyledElement::attributeChanged):

dom/StyledElement.h:
html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::updateType):

mathml/MathMLElement.cpp:

(WebCore::MathMLElement::attributeChanged):

mathml/MathMLElement.h:
mathml/MathMLSelectElement.cpp:

(WebCore::MathMLSelectElement::attributeChanged):

mathml/MathMLSelectElement.h:
svg/SVGElement.cpp:

(WebCore::SVGElement::attributeChanged):

svg/SVGElement.h:

3:01 AM Changeset in webkit [197273] by Carlos Garcia Campos

5 edits
3 adds in releases/WebKitGTK/webkit-2.4

Merge r183649 - Javascript using WebSQL can create their own WebKit info table.
<rdar://problem/20688792> and https://bugs.webkit.org/show_bug.cgi?id=144466

Reviewed by Alex Christensen.

Source/WebCore:

Test: storage/websql/alter-to-info-table.html

Modules/webdatabase/DatabaseBackendBase.cpp:

(WebCore::DatabaseBackendBase::databaseInfoTableName): Return the info table name.
(WebCore::fullyQualifiedInfoTableName): Append "main." to the info table name.
(WebCore::DatabaseBackendBase::DatabaseBackendBase): Use the fully qualified name.
(WebCore::DatabaseBackendBase::performOpenAndVerify): Ditto.
(WebCore::DatabaseBackendBase::getVersionFromDatabase): Ditto.
(WebCore::DatabaseBackendBase::setVersionInDatabase): Ditto.

LayoutTests:

storage/websql/alter-to-info-table-expected.txt: Added.
storage/websql/alter-to-info-table.html: Added.
storage/websql/alter-to-info-table.js: Added.

Build fix after r183646 for less enlightened platforms.

Unreviewed.

Modules/webdatabase/DatabaseBackendBase.cpp:

(WebCore::fullyQualifiedInfoTableName): Windows doesn’t have stpcpy :(

2:52 AM Changeset in webkit [197272] by Carlos Garcia Campos

4 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r182067 - FEMorphology::platformApplyGeneric() should bail out if the radius is less than or equal to zero.
https://bugs.webkit.org/show_bug.cgi?id=142885.

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2015-03-27
Reviewed by Dean Jackson.

Source/WebCore:

FEMorphology class implementation code clean up.

Tests: svg/filters/feMorphology-radius-cases.svg

platform/graphics/filters/FEMorphology.cpp:

(WebCore::shouldSupersedeExtremum): Reuse code instead of repeating it and
use < and > instead of =< and >=.

(WebCore::pixelArrayIndex): Returns the array index of a pixel in an image
buffer, given: position(x, y), image width and the color channel.

(WebCore::columnExtremum): Returns the extremum of a column of pixels.

(WebCore::kernelExtremum): Returns the extremum of a filter kernel.

(WebCore::FEMorphology::platformApplyGeneric): Apply some code clean-up.
The kernel size should be equal to radius of the filter. The extra pixel
was causing the resulted image to be asymmetric in some cases.

(WebCore::FEMorphology::platformApplyDegenerate):
(WebCore::FEMorphology::platformApplySoftware): After applying scaling, we
still need to check the resulted radius is negative (overflow case) or less
than one (zero radius case) and treat these cases differently.

(WebCore::FEMorphology::morphologyOperator): Deleted.
(WebCore::FEMorphology::radiusX): Deleted.
(WebCore::FEMorphology::radiusY): Deleted.

platform/graphics/filters/FEMorphology.h:

(WebCore::FEMorphology::morphologyOperator):
(WebCore::FEMorphology::radiusX):
(WebCore::FEMorphology::radiusY):
Move a single line functions from the source file to the header file.

LayoutTests:

svg/filters/feMorphology-radius-cases-expected.svg: Added.
svg/filters/feMorphology-radius-cases.svg: Added.

Test different cases for radius of the feMorphology filter. There are three
cases for the radius:

radius < 0: This is an error case, the source image should not be rendered.
radius = 0: This case is treated as if the filter never exists.
radius > 0: If the scaled radius is > 0, the filter is applied.

2:44 AM Changeset in webkit [197271] by Carlos Garcia Campos

3 edits
4 adds in releases/WebKitGTK/webkit-2.4

Merge r182750 - Canvas drawImage() has a security hole when the image isn't yet fully loaded.
https://bugs.webkit.org/show_bug.cgi?id=58681.

Reviewed by Darin Adler.

Source/WebCore:

There is a race condition which may happen if an image from a different
origin is drawn on a canvas before it finishes loading. The check to taint
the canvas comes before drawing it. This check returns false if the image
is not completely loaded because we check the URL of the resource response.
If after this check and before the drawing, the image finishes loading, the
canvas will not be tainted but the image will be drawn.

The fix is to move the check to taint the canvas after drawing the image.
The only problem with this solution is basically the opposite of this bug:
we will become stricter than before with images which are from a different
origin and before they finish loading. The image has not finished loading,
so we do not draw it. Before we check for tainting, the image finishes
loading. So we decide to taint the canvas even the image is not drawn.

But this should not be a security issue anymore. I personally do not know
if it is even a correctness issue or not.

Test: http/tests/canvas/canvas-tainted-after-draw-image.html

html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::drawImage):

LayoutTests:

This test confirms when we load an image from a different origin and try
drawing it on a canvas, the canvas is tainted if the image is completely
loaded and drawn. Otherwise the image is not drawn.

http/tests/canvas/canvas-tainted-after-draw-image-expected.txt: Added.
http/tests/canvas/canvas-tainted-after-draw-image.html: Added.
http/tests/canvas/resources: Added.
http/tests/canvas/resources/100x100-lime-rect.svg: Added.

Fix LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html on all bots
following http://trac.webkit.org/changeset/182750.

Reviewed by Daniel Bates.

http/tests/canvas/canvas-tainted-after-draw-image-expected.txt:
http/tests/canvas/canvas-tainted-after-draw-image.html:

Set window.jsTestIsAsync true and call finishJSTest() to make the test
asynchronous, so the "TEST COMPLETE" message will be output after all the
test messages. Also delete the synchronous tests for data url image and
same-domain image since they can't be reliably tested.

2:37 AM Changeset in webkit [197270] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r183398 - Crashes under IDBDatabase::closeConnection
https://bugs.webkit.org/show_bug.cgi?id=141745

Reviewed by Alexey Proskuryakov.

Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::~IDBDatabase): Do the work of close/closeConnection without
actually calling those functions.
(WebCore::IDBDatabase::closeConnection): Protect the database so it's not destroyed
in the middle of this function's execution.

2:35 AM Changeset in webkit [197269] by Carlos Garcia Campos

6 edits in releases/WebKitGTK/webkit-2.4/Source

Merge r180548 - EventHandler references deleted Scrollbar
https://bugs.webkit.org/show_bug.cgi?id=141931
<rdar://problem/19915210>

Reviewed by Tim Horton.

Tested by scrollbars/overflow-custom-scrollbar-crash.html

Update the EventHandler class to use a WeakPtr to reference the
last used Scrollbar, rather than retaining the Scrollbar and
artificially extending its life. This keeps the EventHandler
state in proper sync with the state of the render tree, and
avoids cases where we have destroyed a ScrollableArea (and
Scrollbar) but are still sending messages to a fake zombie
version of the element.

page/EventHandler.cpp:

(WebCore::EventHandler::clear):
(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::updateMouseEventTargetNode):
(WebCore::EventHandler::updateLastScrollbarUnderMouse):

page/EventHandler.h:
platform/Scrollbar.cpp:

(WebCore::Scrollbar::Scrollbar): Initialize WeakPtrFactory.

platform/Scrollbar.h:

(WebCore::Scrollbar::createWeakPtr): Added,

2:01 AM Changeset in webkit [197268] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r181565 - URLs visited during private browsing show up in WebpageIcons.db
rdar://problem/11254910 and https://bugs.webkit.org/show_bug.cgi?id=142733

Patch by Sam Weinig. Reviewed by Brady Eidson.

loader/icon/IconController.cpp:

(WebCore::IconController::startLoader): Bail early here if the page is using an ephemeral session.
(WebCore::IconController::continueLoadWithDecision): Instead of here.

1:51 AM Changeset in webkit [197267] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.4

Merge r182051 - Inline continuation code should not take anonymous containing wrapper granted.
https://bugs.webkit.org/show_bug.cgi?id=133312

Reviewed by Dave Hyatt.

It's wrong to assume that when RenderInline is part of an inline continuation, its containing block
is an anonymous wrapper and its sibling might be a block level renderer.
When the inline continuation is no longer needed, for example when the block level renderer that initiated the continuation
is detached from the render tree, the inline renderes still continue to form continuation.(however they no longer require
anonymous wrappers)

Source/WebCore:

Test: fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html

rendering/RenderInline.cpp:

(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):

LayoutTests:

fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation-expected.txt: Added.
fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html: Added.

1:37 AM Changeset in webkit [197266] by Carlos Garcia Campos

4 edits
4 adds in releases/WebKitGTK/webkit-2.4

Merge r177165 - InstancedArray crashes attempting to draw out of bounds
https://bugs.webkit.org/show_bug.cgi?id=139521
Source/WebCore:

Reviewed by Simon Fraser.

We were not doing index validation correctly for instancing.

Test: fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html

html/canvas/WebGLRenderingContext.cpp:

(WebCore::WebGLRenderingContext::validateVertexAttributes): We need to check
the number of instances drawn against the amount of instance data that has
been provided, taking into account the number of repeats (the divisor).
(WebCore::WebGLRenderingContext::drawArrays): Added some whitespace to make it more clear.
(WebCore::WebGLRenderingContext::validateDrawElements): This needs to take a primcount
parameter so that it can correctly validate the call (when used from drawElementsInstanced).
(WebCore::WebGLRenderingContext::drawElements): New signature to validate.
(WebCore::WebGLRenderingContext::drawArraysInstanced): Rearrange this a bit. The
primcount validation is already being done by the validateDrawArrays call. Also, there
was a bogus UNUSED_PARAM hanging around.
(WebCore::WebGLRenderingContext::drawElementsInstanced): Similar rearrangement. Use
the primcount parameter.

html/canvas/WebGLRenderingContext.h:

LayoutTests:

<rdar://problem/17540398>

Reviewed by Simon Fraser.

This is a copy of the official webgl/1.0.3 test.

platform/mac-mountainlion/fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt: Added. This extension is not available on Mountain Lion.
fast/canvas/webgl/angle-instanced-arrays-out-of-bounds-expected.txt: Added.
fast/canvas/webgl/angle-instanced-arrays-out-of-bounds.html: Added.
fast/canvas/webgl/resources/out-of-bounds-test.js: Added.

(OutOfBoundsTest):

12:01 AM Changeset in webkit [197265] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: DataGrid's resizers aren't horizontally centered
https://bugs.webkit.org/show_bug.cgi?id=154787
<rdar://problem/24876901>

Reviewed by Timothy Hatcher.

UserInterface/Views/DataGrid.css:

(.data-grid .resizer):
Use CSS transforms as margin-left doesn't support sub-pixel values.

Feb 27, 2016:

7:33 PM Changeset in webkit [197264] by Sukolsak Sakshuwong

1 edit
1 delete in trunk/LayoutTests

Removing ios-simulator baseline for js/number-toLocaleString.html
https://bugs.webkit.org/show_bug.cgi?id=154524

Reviewed by Darin Adler.

The default locale issue has been fixed in r197261.
Infinity.toLocaleString() should return "∞" as expected.

platform/ios-simulator/js/number-toLocaleString-expected.txt: Removed.

4:50 PM Changeset in webkit [197263] by Chris Dumez

10 edits in trunk

Prevent cross-origin access to Location.assign() / Location.reload()
https://bugs.webkit.org/show_bug.cgi?id=154779

Reviewed by Darin Adler.

Source/WebCore:

Prevent cross-origin access to Location.assign() / Location.reload()
to match the latest specification:

https://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)

Firefox and Chrome already prevent this but WebKit allowed it.

No new tests, already covered by existing tests.

bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::getOwnPropertySlotDelegate):
(WebCore::JSLocation::putDelegate): Deleted.

LayoutTests:

Update existing layout tests now that we prevent cross-origin access to
Location.assign() / Location.reload().

http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:
http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:
http/tests/security/cross-frame-access-location-get-expected.txt:
http/tests/security/cross-frame-access-location-get-override-expected.txt:
http/tests/security/cross-frame-access-location-get-override.html:
http/tests/security/cross-frame-access-location-get.html:
http/tests/security/xss-DENIED-defineProperty-expected.txt:

4:40 PM Changeset in webkit [197262] by ap@apple.com

2 edits in trunk/Tools

Silence leaks under TextCodecICU::registerCodecs
https://bugs.webkit.org/show_bug.cgi?id=154737

Reviewed by Darin Adler.

Scripts/webkitpy/port/leakdetector.py:

(LeakDetector._callstacks_to_exclude_from_leaks):

4:36 PM Changeset in webkit [197261] by commit-queue@webkit.org

20 edits in trunk

Intl.Collator uses POSIX locale (detected by js/intl-collator.html on iOS Simulator)
https://bugs.webkit.org/show_bug.cgi?id=152448

Patch by Andy VanWagoner <thetalecrafter@gmail.com> on 2016-02-27
Reviewed by Darin Adler.

Source/JavaScriptCore:

Add defaultLanguage to the globalObjectMethodTable and use it for the
default locale in Intl object initializations. Fall back to ICU default
locale only if the defaultLanguage function is null, or returns an
empty string.

jsc.cpp:
runtime/IntlCollator.cpp:

(JSC::IntlCollator::initializeCollator):

runtime/IntlDateTimeFormat.cpp:

(JSC::IntlDateTimeFormat::initializeDateTimeFormat):

runtime/IntlNumberFormat.cpp:

(JSC::IntlNumberFormat::initializeNumberFormat):

runtime/IntlObject.cpp:

(JSC::defaultLocale):
(JSC::lookupMatcher):
(JSC::bestFitMatcher):
(JSC::resolveLocale):

runtime/IntlObject.h:
runtime/JSGlobalObject.cpp:
runtime/JSGlobalObject.h:
runtime/StringPrototype.cpp:

(JSC::toLocaleCase):

Source/WebCore:

Pass defaultLanguage from Language.h to the globalObjectMethodTable to
ensure Intl objects can be initialized with the correct default locale.

bindings/js/JSDOMWindowBase.cpp:
bindings/js/JSWorkerGlobalScopeBase.cpp:

LayoutTests:

Add tests for default locale in test runner to be en-US.

js/intl-collator-expected.txt:
js/intl-datetimeformat-expected.txt:
js/intl-numberformat-expected.txt:
js/script-tests/intl-collator.js:
js/script-tests/intl-datetimeformat.js:
js/script-tests/intl-numberformat.js:

4:35 PM Changeset in webkit [197260] by Chris Dumez

9 edits in trunk

Align HTMLMarqueeElement.scrollAmount / scrollDelay with the specification
https://bugs.webkit.org/show_bug.cgi?id=154781

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/reflection-obsolete-expected.txt:

Source/WebCore:

Align HTMLMarqueeElement.scrollAmount / scrollDelay with the
specification:

https://www.w3.org/TR/html5/obsolete.html#the-marquee-element-0

In particular:

The attributes should have unsigned long type
We should not throw for negative values
Values should be in the range [0, 2147483647] as per:
https://html.spec.whatwg.org/multipage/infrastructure.html#reflect

No new tests, already covered by existing tests.

html/HTMLMarqueeElement.cpp:

(WebCore::HTMLMarqueeElement::scrollAmount):
(WebCore::HTMLMarqueeElement::setScrollAmount):
(WebCore::HTMLMarqueeElement::scrollDelay):
(WebCore::HTMLMarqueeElement::setScrollDelay):
(WebCore::HTMLMarqueeElement::loop): Deleted.

html/HTMLMarqueeElement.h:
html/HTMLMarqueeElement.idl:

LayoutTests:

Update existing test to reflect the behavior changes.

fast/html/marquee-element-expected.txt:
fast/html/marquee-element.html:

1:05 PM Changeset in webkit [197259] by commit-queue@webkit.org

24 edits in trunk/Source

Unreviewed, rolling out r197204, r197207, r197211, r197217,
r197218, and r197219.
https://bugs.webkit.org/show_bug.cgi?id=154780

Caused crashes in WebVideoFullscreenManagerProxy (Requested by
ap on #webkit).

Reverted changesets:

"Add support for playbackControlsManager"
https://bugs.webkit.org/show_bug.cgi?id=154742
http://trac.webkit.org/changeset/197204

"Attempted build fix."
http://trac.webkit.org/changeset/197207

"Attempted build fix."
http://trac.webkit.org/changeset/197211

"Attempted 32-bit build fix."
http://trac.webkit.org/changeset/197217

"Another 32-bit build fix."
http://trac.webkit.org/changeset/197218

"32-bit!!!"
http://trac.webkit.org/changeset/197219

12:20 PM Changeset in webkit [197258] by ap@apple.com

2 edits in trunk/LayoutTests

Mark failing reftests as such, now that we detect reftest failures.

platform/ios-simulator/TestExpectations:

12:01 PM Changeset in webkit [197257] by ap@apple.com

2 edits in trunk/LayoutTests

REGRESSION(r195795): [WK2] fast/text/crash-complex-text-surrogate.html is flakey
https://bugs.webkit.org/show_bug.cgi?id=154709

The test has been made made non-flaky, but it also needs new results.

platform/mac/fast/text/crash-complex-text-surrogate-expected.txt:

11:57 AM WebKitGTK/2.10.x edited by Michael Catanzaro

Propose r196467 as it could probably be used to workaround Red Hat #1311519 (diff)

11:28 AM Changeset in webkit [197256] by oliver@apple.com

2 edits in trunk/Source/JavaScriptCore

CLoop build fix.

10:30 AM Changeset in webkit [197255] by Chris Dumez

2 edits in trunk/Source/WebCore

Optimize parseHTMLInteger()
https://bugs.webkit.org/show_bug.cgi?id=154772

Reviewed by Ryosuke Niwa.

Optimize parseHTMLInteger() a bit now that it is used a lot more and
that it has decent API test coverage. In particular, we now:

Avoid using a StringBuilder for the digits.
Get rid of a is8Bit() branch.
Only traverse the input string once.

html/parser/HTMLParserIdioms.cpp:

(WebCore::parseHTMLIntegerInternal):
(WebCore::parseHTMLInteger):
(WebCore::parseHTMLNonNegativeInteger): Deleted.

9:49 AM Changeset in webkit [197254] by akling@apple.com

4 edits in trunk/Source/WebCore

[iOS] Discard decoded image data on top-level navigation.
<https://webkit.org/b/154776>

Reviewed by Anders Carlsson.

Add a mechanism that destroys decoded data for all CachedImages and invoke it
when performing a top-level navigation on iOS.

This substantially reduces the ImageIO contribution to our peak memory footprint.

It would be even better if we could mark these images volatile during the transition
but we currently don't have framework support for such machinations.

loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad):

loader/cache/MemoryCache.cpp:

(WebCore::MemoryCache::forEachResource):
(WebCore::MemoryCache::destroyDecodedDataForAllImages):

loader/cache/MemoryCache.h:

7:10 AM Changeset in webkit [197253] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r196364 - [GTK] Toggle buttons are blurry with GTK+ 3.19
https://bugs.webkit.org/show_bug.cgi?id=154007

Reviewed by Michael Catanzaro.

Use min-width/min-height style properties when GTK+ >= 3.19.7 to
get the size of toggle buttons.

rendering/RenderThemeGtk.cpp:

(WebCore::setToggleSize):
(WebCore::paintToggle):

7:09 AM Changeset in webkit [197252] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r194847 - [GTK] Cleanup RenderThemeGtk
https://bugs.webkit.org/show_bug.cgi?id=152888

Reviewed by Michael Catanzaro.

Use a common path for GTK+ 3.19 and previous versions, simplifying
the code and removing a lot of ifdefs.

createStyleContext() now receives a theme part enum value, and an optional parent GtkStyleContext. It encapsulates all the differences between GTK+ 3.19 and previous version leaving the rendering code common and free of ifdefs.
Stock icons support have been removed, simplifying the code that now always renders symbolic icons, updating the colors depending on the current state.
Media button and colors have been removed, because they are unused now that we render the media controls with CSS.
ComboBox separators support has also been removed. In GTK+ 3.19 combo boxes no longer have separators and most of the GTK+ themes don't use the either, so it's better to simple not render them anymore in WebKit either.
Code to paint caps lock indicator has been removed too, since caps lock indicator is now shadow dom and automatically rendered by WebCore.

rendering/RenderThemeGtk.cpp:

(WebCore::createStyleContext):
(WebCore::loadThemedIcon):
(WebCore::gtkIconStateFlags):
(WebCore::RenderThemeGtk::adjustRepaintRect):
(WebCore::setToggleSize):
(WebCore::paintToggle):
(WebCore::RenderThemeGtk::setCheckboxSize):
(WebCore::RenderThemeGtk::paintCheckbox):
(WebCore::RenderThemeGtk::setRadioSize):
(WebCore::RenderThemeGtk::paintRadio):
(WebCore::RenderThemeGtk::paintButton):
(WebCore::getComboBoxMetrics):
(WebCore::RenderThemeGtk::popupInternalPaddingLeft):
(WebCore::RenderThemeGtk::popupInternalPaddingRight):
(WebCore::RenderThemeGtk::popupInternalPaddingTop):
(WebCore::RenderThemeGtk::popupInternalPaddingBottom):
(WebCore::RenderThemeGtk::paintMenuList):
(WebCore::RenderThemeGtk::paintTextField):
(WebCore::adjustSearchFieldIconStyle):
(WebCore::RenderThemeGtk::adjustSearchFieldResultsDecorationPartStyle):
(WebCore::paintIcon):
(WebCore::paintEntryIcon):
(WebCore::RenderThemeGtk::paintSearchFieldResultsDecorationPart):
(WebCore::RenderThemeGtk::adjustSearchFieldCancelButtonStyle):
(WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
(WebCore::RenderThemeGtk::shouldHaveCapsLockIndicator):
(WebCore::RenderThemeGtk::paintSliderTrack):
(WebCore::RenderThemeGtk::paintSliderThumb):
(WebCore::RenderThemeGtk::adjustSliderThumbSize):
(WebCore::RenderThemeGtk::paintProgressBar):
(WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
(WebCore::paintSpinArrowButton):
(WebCore::RenderThemeGtk::paintInnerSpinButton):
(WebCore::styleColor):
(WebCore::RenderThemeGtk::platformActiveSelectionBackgroundColor):
(WebCore::RenderThemeGtk::platformInactiveSelectionBackgroundColor):
(WebCore::RenderThemeGtk::platformActiveSelectionForegroundColor):
(WebCore::RenderThemeGtk::platformInactiveSelectionForegroundColor):
(WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor):
(WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor):
(WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor):
(WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor):
(WebCore::RenderThemeGtk::systemColor):
(WebCore::RenderThemeGtk::paintMediaButton):
(WebCore::RenderThemeGtk::paintMediaFullscreenButton):
(WebCore::RenderThemeGtk::paintMediaMuteButton):
(WebCore::RenderThemeGtk::paintMediaPlayButton):
(WebCore::RenderThemeGtk::paintMediaSeekBackButton):
(WebCore::RenderThemeGtk::paintMediaSeekForwardButton):
(WebCore::RenderThemeGtk::paintMediaToggleClosedCaptionsButton):

rendering/RenderThemeGtk.h:

7:09 AM Changeset in webkit [197251] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r194377 - [GTK] Everything broken in GTK+ 3.19
https://bugs.webkit.org/show_bug.cgi?id=150550

Reviewed by Carlos Garcia Campos.

Port RenderThemeGtk and ScrollbarThemeGtk to use CSS nodes. This makes it possible to render
stuff with modern GTK+.

No new tests. We already have tons of tests for this functionality, but we're running them
with GTK+ 3.16, so they cannot have detected this breakage. These fixes require unreleased
GTK+, and GTK+ rendering is currently in a state of flux; once things settle down, we can
consider upgrading the GTK+ used for our layout tests.

platform/gtk/GRefPtrGtk.cpp:

(WTF::refGPtr):
(WTF::derefGPtr):

platform/gtk/GRefPtrGtk.h:
platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::themeChanged):
(WebCore::ScrollbarThemeGtk::updateThemeProperties):
(WebCore::orientationStyleClass):
(WebCore::applyScrollbarStyleContextClasses):
(WebCore::ScrollbarThemeGtk::paintTrackBackground):
(WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
(WebCore::ScrollbarThemeGtk::paintThumb):
(WebCore::ScrollbarThemeGtk::paintButton):

rendering/RenderThemeGtk.cpp:

(WebCore::createStyleContext):
(WebCore::setToggleSize):
(WebCore::paintToggle):
(WebCore::RenderThemeGtk::paintButton):
(WebCore::getComboBoxMetrics):
(WebCore::RenderThemeGtk::paintMenuList):
(WebCore::RenderThemeGtk::paintTextField):
(WebCore::applySliderStyleContextClasses):
(WebCore::RenderThemeGtk::paintSliderTrack):
(WebCore::RenderThemeGtk::paintSliderThumb):
(WebCore::RenderThemeGtk::paintProgressBar):
(WebCore::paintSpinArrowButton):
(WebCore::styleColor):

7:09 AM Changeset in webkit [197250] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r173110, r193896 - [GTK] ScrollbarThemeGtk should not depend on RenderThemeGtk
https://bugs.webkit.org/show_bug.cgi?id=136338

Reviewed by Philippe Normand.

Remove the dependency by creating the GtkStyleContext for the
scrollbars in ScrollbarThemeGtk.

platform/gtk/RenderThemeGtk.cpp:

(WebCore::gtkStyleChangedCallback): Call ScrollbarThemeGtk::themeChanged().
(WebCore::getStyleContext): Remove the scrollbar style context support.

platform/gtk/RenderThemeGtk.h: Remove gtkScrollbarStyle().
platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarStyleContext::ScrollbarStyleContext): Helper
class to create the global GtkStyleContext for scrollbars.
(WebCore::ScrollbarStyleContext::~ScrollbarStyleContext):
(WebCore::ScrollbarStyleContext::context):
(WebCore::gtkScrollbarStyleContext):
(WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk): Remove m_context initialization.
(WebCore::ScrollbarThemeGtk::themeChanged): Invalidate the
GtkStylecontext and call updateThemeProperties().
(WebCore::ScrollbarThemeGtk::updateThemeProperties): Use the
global style context.
(WebCore::ScrollbarThemeGtk::paintTrackBackground): Ditto.
(WebCore::ScrollbarThemeGtk::paintScrollbarBackground): Ditto.
(WebCore::ScrollbarThemeGtk::paintThumb): Ditto.
(WebCore::ScrollbarThemeGtk::paintButton): Ditto.

platform/gtk/ScrollbarThemeGtk.h:

[GTK] RenderThemeGtk::platformActiveSelectionBackgroundColor, et. al. should not clobber state of cached GtkStyleContexts
https://bugs.webkit.org/show_bug.cgi?id=151533

Reviewed by Carlos Garcia Campos.

Remove the style context cache to simplify the code, drastically reduce the number of
expensive save/restore operations performed on style contexts, and avoid unwanted
side-effects in RenderThemeGtk::styleColor. This is also a speculative fix for improper
button rendering with certain custom themes, and a simplification that will make it easier
to fix bug #150550.

This change does have performance implications, which I intend to check on the perf bot
after landing to ensure that removing the cache does not have a significant negative impact
on performance; I have no clue whether this will be a net performance win or loss. However,
this is a bit tricky, because the bot is running GTK+ 3.16, whereas I expect save/restore
might be much more expensive in GTK+ 3.20, and I do not want to make performance decisions
except based on the latest GTK+ due to large changes in the implementation of

7:08 AM Changeset in webkit [197249] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r192724 - [GTK] Off-by-one error in getStyleContext()
https://bugs.webkit.org/show_bug.cgi?id=151524

Reviewed by Carlos Garcia Campos.

GtkWidgetPath* path = gtk_widget_path_new();
gtk_widget_path_append_type(path, widgetType);
...
gtk_widget_path_iter_add_class(path, 0, GTK_STYLE_CLASS_BUTTON);
gtk_widget_path_iter_add_class(path, 1, "text-button");

Only one widget type was appended to the widget path, so the maximum valid index is 0. This
code means to add both style classes to the first widget type in the widget path, so the
second call should use index 0 rather than index 1.

This caused no bug in practice, because when the index is invalid,
gtk_widget_path_iter_add_class() automatically changes the index to the last valid position
in the widget path -- in this case, 0. This is routinely done with -1 as a convention for
specifying the last position in the widget path.

rendering/RenderThemeGtk.cpp:

(WebCore::getStyleContext):

7:08 AM Changeset in webkit [197248] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore

Merge r192723 - [GTK] Warning spam from GtkStyleContext
https://bugs.webkit.org/show_bug.cgi?id=151520

Reviewed by Carlos Garcia Campos.

Audit every use of gtk_style_context_get_* to fix compatibility with GTK+ 3.19. Some of
these were already fine and are only changed for clarity.

Company: gtk_style_context_get() (and _get_padding/border/color()) should only ever be

called with the same state as gtk_style_context_get_state()

Company: usually that's a simple replacing of the old state (like in the trace you posted)
Company: sometimes it requires calling gtk_style_context_set_sate() with the right state

first

Company: and in very rare cases it needs a gtk_style_context_save() before the set_state(),

too

platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::adjustRectAccordingToMargin):

rendering/RenderThemeGtk.cpp:

(gtk_css_section_print):
(WebCore::getStyleContext):
(WebCore::RenderThemeGtk::initMediaColors):
(WebCore::renderButton):
(WebCore::getComboBoxMetrics):
(WebCore::RenderThemeGtk::paintMenuList):
(WebCore::RenderThemeGtk::paintTextField):
(WebCore::RenderThemeGtk::paintProgressBar):
(WebCore::spinButtonArrowSize):
(WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
(WebCore::styleColor):

7:02 AM Changeset in webkit [197247] by Carlos Garcia Campos

3 edits
5 adds in releases/WebKitGTK/webkit-2.4

Merge r190662 - [GTK] Progress bar is broken on recent GTK+
https://bugs.webkit.org/show_bug.cgi?id=149831

Reviewed by Carlos Garcia Campos.

Source/WebCore:

The gtk progress bar has been broken after bumping up to Gtk+-3.16. This is because
the way of rendering progress bar changed after gtk+-3.13.7. See more
https://mail.gnome.org/archives/commits-list/2014-August/msg03865.html
gtk_render_activity is no longer valid to paint a progress bar on a newer gtk+.
It should be done with gtk_render_background and gtk_render_frame.

Test: fast/dom/HTMLProgressElement/native-progress-bar.html

rendering/RenderThemeGtk.cpp:

(WebCore::RenderThemeGtk::paintProgressBar):

LayoutTests:

fast/dom/HTMLProgressElement/native-progress-bar.html: Added.
platform/gtk/fast/dom/HTMLProgressElement/native-progress-bar-expected.png: Added.
platform/gtk/fast/dom/HTMLProgressElement/native-progress-bar-expected.txt: Added.
platform/mac/fast/dom/HTMLProgressElement/native-progress-bar-expected.png: Added.
platform/mac/fast/dom/HTMLProgressElement/native-progress-bar-expected.txt: Added.

Feb 26, 2016:

11:45 PM Changeset in webkit [197246] by Carlos Garcia Campos

2 edits in trunk/Source/WebKit2

Unreviewed. Fix GTK+ clean build.

Add missing header include.

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

11:44 PM Changeset in webkit [197245] by Nikita Vasilyev

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Increase clickable area of the console prompt
https://bugs.webkit.org/show_bug.cgi?id=154719
<rdar://problem/24854538>

Reviewed by Timothy Hatcher.

Clicking on the area around CodeMirror element now moves
focus to the console prompt.

UserInterface/Views/QuickConsole.js:

(WebInspector.QuickConsole.prototype._handleMouseDown):
Only capture mousedown events on .quick-console.
Don't capture clicks on CodeMirror.

UserInterface/Views/QuickConsole.css:

(.quick-console > .console-prompt):
(.quick-console > .console-prompt > .CodeMirror):
Make sure .console-prompt is never an event.target for _handleMouseDown.

11:44 PM Changeset in webkit [197244] by Carlos Garcia Campos

8 edits in trunk/Source

Network cache: old pages returned by disk cache on history navigation after session is restored
https://bugs.webkit.org/show_bug.cgi?id=153230

Reviewed by Chris Dumez.

Source/WebCore:

history/HistoryItem.h:

(WebCore::HistoryItem::setWasRestoredFromSession):
(WebCore::HistoryItem::wasRestoredFromSession):

loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadDifferentDocumentItem):

Source/WebKit2:

WebProcess/WebPage/WebBackForwardListProxy.cpp:

(WebKit::WebBackForwardListProxy::addItemFromUIProcess): Use Ref&&
instead of PassRefPtr.

WebProcess/WebPage/WebBackForwardListProxy.h:
WebProcess/WebPage/WebPage.cpp:

WebProcess/WebPage/WebPage.h:

11:26 PM Changeset in webkit [197243] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Remove unused member variables from overview graphs
https://bugs.webkit.org/show_bug.cgi?id=154774

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-26
Reviewed by Timothy Hatcher.

UserInterface/Views/LayoutTimelineOverviewGraph.js:

(WebInspector.LayoutTimelineOverviewGraph.prototype.reset):

UserInterface/Views/ScriptTimelineOverviewGraph.js:

(WebInspector.ScriptTimelineOverviewGraph.prototype.reset):

11:17 PM Changeset in webkit [197242] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

REGRESSION (r196741): Web Inspector: Bottom section of Layers sidebar is 1px shorter than the console prompt
https://bugs.webkit.org/show_bug.cgi?id=154773
<rdar://problem/24873345>

Reviewed by Timothy Hatcher.

UserInterface/Views/LayerTreeDetailsSidebarPanel.css:

(.sidebar > .panel.details.layer-tree > .content):
(.panel.details.layer-tree .bottom-bar):

10:19 PM Changeset in webkit [197241] by Michael Catanzaro

2 edits in trunk/Tools

[GTK] Fix incorrect cast

Unreviewed.

MiniBrowser/gtk/main.c:

(createBrowserWindow):

10:16 PM Changeset in webkit [197240] by Michael Catanzaro

3 edits in trunk/Source/WebCore

Remove unused private field from WEBPImageDecoder

Unreviewed.

platform/image-decoders/webp/WEBPImageDecoder.cpp:

(WebCore::WEBPImageDecoder::WEBPImageDecoder):

platform/image-decoders/webp/WEBPImageDecoder.h:

10:11 PM Changeset in webkit [197239] by Michael Catanzaro

2 edits in trunk/Source/WebKit2

Fix a typo.

Unreviewed. Shame I didn't notice in the previous commit.

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::removeUserContentWorld):

10:09 PM Changeset in webkit [197238] by Michael Catanzaro

4 edits in trunk/Source/WebKit2

Fix GTK and maybe EFL build after r197172.

Unreviewed.

CMakeLists.txt:
UIProcess/API/gtk/WebKitUserContent.cpp:

(_WebKitUserScript::_WebKitUserScript):

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::removeUserContentWorld):
(WebKit::WebUserContentController::addUserScripts):
(WebKit::WebUserContentController::removeUserScript):
(WebKit::WebUserContentController::removeAllUserScripts):

10:09 PM Changeset in webkit [197237] by Chris Dumez

10 edits
2 adds in trunk

Fix the behavior of reflecting IDL attributes of type unsigned long
https://bugs.webkit.org/show_bug.cgi?id=154771

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/reflection-embedded-expected.txt:
web-platform-tests/html/dom/reflection-obsolete-expected.txt:

Source/WebCore:

Fix the behavior of reflecting IDL attributes of type unsigned long to
align with the specification:

Firefox and Chrome already follow the specification.

There were several issues with our implementation, which are all
addressed in this patch:

Upon getting, the value returned must be in the range 0 to 2147483647. Otherwise, we must return the default value (0 unless specified otherwise). We previously returned values in the range 0 to 4294967295 instead.
Upon setting, we must set the content attribute to the default value (0 unless specified otherwise) if the input value is not in the range 0 to 2147483647. We previously allowed values in the range 0 to 4294967295 instead.
"-0" was not recognized as a valid unsigned integer

Test: fast/dom/reflect-unsigned-long.html

dom/Element.cpp:

(WebCore::Element::setUnsignedIntegralAttribute):
Update setUnsignedIntegralAttribute() to limit the input value in the
0 to 2147483647 range, as per the HTML specification. This method is
called by the bindings implementation of reflecting attributes setters.

html/parser/HTMLParserIdioms.cpp:

(WebCore::parseHTMLNonNegativeInteger):
Update parseHTMLNonNegativeInteger() to call parseHTMLInteger() instead
of duplicating most of its code and fail if the value returned is
negative. This matches the algorithm in the specification:

https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers

This has 2 behavior changes:

"-0" is now correctly parsed as 0.
The returned values are in the range 0 to 2147483647.

html/parser/HTMLParserIdioms.h:

(WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
(WebCore::limitToOnlyHTMLNonNegative):
Drop the checks for "<= 2147483647" and replace with an assertion
now that parseHTMLNonNegativeInteger() already returned values in
the right range.

Tools:

Update API tests to cover the fixes to the parseHTMLNonNegativeInteger()
implementation:

"-0" is parsed as 0.
Range boundaries are now [0; 2147483647].

TestWebKitAPI/Tests/WebCore/HTMLParserIdioms.cpp:

(TestWebKitAPI::TEST):

LayoutTests:

Add test coverage for the behavior of reflecting IDL attributes of type
unsigned long.

fast/dom/reflect-unsigned-long-expected.txt: Added.
fast/dom/reflect-unsigned-long.html: Added.

9:51 PM Changeset in webkit [197236] by Michael Catanzaro

2 edits in trunk/Source/WebKit2

[GTK] Fix order of parameters in gtkdoc for webkit_web_view_get_snapshot

Unreviewed.

UIProcess/API/gtk/WebKitWebView.cpp:

9:40 PM Changeset in webkit [197235] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Custom transition bezier curve editor preview should loop when not editing curve
https://bugs.webkit.org/show_bug.cgi?id=154738
<rdar://problem/24861563>

Patch by Devin Rousso <Devin Rousso> on 2016-02-26
Reviewed by Timothy Hatcher.

Added extra frames to bezier preview animation to allow it to infinitely
repeat without being jarring to watch.

UserInterface/Views/BezierEditor.css:

(.bezier-editor > .bezier-preview-timing.animate):
(@keyframes bezierPreview):

UserInterface/Views/BezierEditor.js:

9:11 PM Changeset in webkit [197234] by Alan Bujtas

21 edits in trunk

REGRESSION (188611): Search field Cancel button should not overlap search text on extensions page.
https://bugs.webkit.org/show_bug.cgi?id=154692
<rdar://problem/22840453>

Reviewed by Brent Fulgham.

Adjust the cancel button position using the actual size of the cancel button.

When the input box and the font height trigger different cancel button sizes, we need to readjust
the rectangle returned by cancelButtonRectForBounds.
This fixes both the mispositioned cancel button and the squared off icon when the input field is zoomed all the way in.

Source/WebCore:

Covered by existing tests.

rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::paintSearchFieldCancelButton):
(WebCore::RenderThemeMac::cancelButtonSizes): Update button size.

LayoutTests:

fast/forms/search/search-padding-cancel-results-buttons-expected.txt:
platform/mac/fast/css/focus-ring-exists-for-search-field-expected.txt:
platform/mac/fast/css/text-input-with-webkit-border-radius-expected.txt:
platform/mac/fast/css/text-overflow-input-expected.txt:
platform/mac/fast/forms/box-shadow-override-expected.txt:
platform/mac/fast/forms/control-restrict-line-height-expected.txt:
platform/mac/fast/forms/input-appearance-height-expected.txt:
platform/mac/fast/forms/placeholder-position-expected.txt:
platform/mac/fast/forms/placeholder-pseudo-style-expected.txt:
platform/mac/fast/forms/search-cancel-button-style-sharing-expected.txt:
platform/mac/fast/forms/search-display-none-cancel-button-expected.txt:
platform/mac/fast/forms/search-rtl-expected.txt:
platform/mac/fast/forms/search-styled-expected.txt:
platform/mac/fast/forms/search-vertical-alignment-expected.txt:
platform/mac/fast/forms/search/search-size-with-decorations-expected.txt:
platform/mac/fast/forms/searchfield-heights-expected.txt:
platform/mac/fast/repaint/search-field-cancel-expected.txt:
platform/mac/fast/replaced/width100percent-searchfield-expected.txt:

8:54 PM Changeset in webkit [197233] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Keyboard controls to nudge control points in custom transition bezier curve editor would be nice
https://bugs.webkit.org/show_bug.cgi?id=154739
<rdar://problem/24861498>

Patch by Devin Rousso <Devin Rousso> on 2016-02-26
Reviewed by Timothy Hatcher.

Adds ability for user to nudge the most recently selected bezier control
handle by using the arrow keys. Also makes the currently selected bezier
control line snap to an axis, which is defined when the user mouses down,
whenever the mouse is dragged while the shift key is pressed.

UserInterface/Views/BezierEditor.js:

(WebInspector.BezierEditor):
(WebInspector.BezierEditor.prototype.handleKeydownEvent):
(WebInspector.BezierEditor.prototype._handleMouseup):
(WebInspector.BezierEditor.prototype._updateControlPointsForMouseEvent):

8:43 PM Changeset in webkit [197232] by jonlee@apple.com

4 edits in trunk/PerformanceTests

Address Dean's comments in 154673.

Animometer/developer.html:
Animometer/resources/debug-runner/animometer.js:
Animometer/resources/debug-runner/graph.js:

8:39 PM Changeset in webkit [197231] by beidson@apple.com

12 edits
3 adds in trunk

Modern IDB: New database versions are never committed to SQLite.
<rdar://problem/24860952> and https://bugs.webkit.org/show_bug.cgi?id=154741

Modern IDB: If a database handle is not open, files are not actually deleted from disk
https://bugs.webkit.org/show_bug.cgi?id=154756

Reviewed by Alex Christensen.

Source/WebCore:

Tested by API test "IndexedDBPersistence"

Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::deleteDatabase): If there's not an open handle to the database, create one.

Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction): If a version change transaction, actually

set the new version on disk.

Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
(WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore): If there is no open backing store, create one.

This is necessary to both read the current database version, and to actually delete the file on disk.

(WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore): If necessary, manufacture a "most recently

deleted database info" from the version returned by deleteBackingStore.

Modules/indexeddb/server/UniqueIDBDatabase.h:

Source/WebKit2:

Add WK2 SPI to force termination of the database process.

UIProcess/API/Cocoa/WKProcessPool.mm:

(-[WKProcessPool _terminateDatabaseProcess]):

UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::terminateDatabaseProcess):

UIProcess/WebProcessPool.h:

Tools:

This also happens to test the previously untested fix for http://trac.webkit.org/changeset/197190

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence-1.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence-2.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBPersistence.mm: Added.

(-[IndexedDBNavigationDelegate webView:didFinishNavigation:]):
(-[IndexedDBMessageHandler userContentController:didReceiveScriptMessage:]):
(TEST):

8:33 PM Changeset in webkit [197230] by jonlee@apple.com

4 edits in trunk/PerformanceTests

Update animation benchmark and tests
https://bugs.webkit.org/show_bug.cgi?id=154673

Reviewed by Dean Jackson.

Update test visuals.

Animometer/tests/master/resources/canvas-tests.js:

(CanvasLineSegment.Utilities.createClass): Line segments near the edge of the stage get clipped.
Update circle position and radius to minimize impact.

Animometer/tests/master/resources/particles.js: Get rid of rotating gradient background, and

have 3 locations for emitting particles.

Animometer/tests/master/resources/multiply.js: Update distance metric so that fringe tiles get

more color.
(initialize): Fix some of the math for laying out the tiles.
(animate): When a tile isn't used, set visibility: hidden.

8:32 PM Changeset in webkit [197229] by jonlee@apple.com

37 edits
1 add
2 deletes in trunk/PerformanceTests

Update animation benchmark and tests
https://bugs.webkit.org/show_bug.cgi?id=154673

Reviewed by Dean Jackson.

Update the ramp controller.

The controller refines the complexity interval to test across.

Animometer/resources/statistics.js: Add functions that estimate cumulative distribution function.

(Regression): For the flat regression, force the first segment to be at 60 fps.
(valueAt): Add convenience function to return interpolated value based on the regression used.
(_calculateRegression): Include the number of points included for both segments, and the piecewise
errors.

Animometer/tests/resources/math.js: Make the Kalman estimator subclass Experiment, and allow it

to be reset.

Animometer/tests/resources/main.js: Initialize the tier such that it starts at 10^{0 = 1.}

Increase the number of ramps. Maintain three FPS thresholds-- the frame rate of interest, a limit
on the lowest FPS we care to go for later interpolation, and a minimum FPS threshold we want to
aim for each ramp. Also keep three estimators: a running average of the change point, a minimum
boundary for each ramp, and an estimator for all the frames within an interval. The first two
are used to determine the parameters of the next ramp, and the latter allows us to refine the
parameters.
(update): During the tier phase, it is possible that the highest complexity possible for a test
won't stress the system enough to trigger stopping the tier phase and transitioning to the ramps.
If the complexity doesn't change when going to the next tier, we've maxed the test out, and move
on. When the tier phase completed, turn off Controller.frameLengthEstimator, which estimates the
FPS at each tier.
(tune): At each interval, look at the confidence distribution of being on the 60 FPS side or the
slow side. If the slowest FPS we achieve at the ramp's maximum complexity is not at least
_fpsRampSlowThreshold, then increase the maximum complexity. If we ever achieve 60 FPS, increase
the ramp's minimum complexity to that level. If, at an even lower complexity, a glitch causes the
FPS to drop, we reset the minimum complexity.

Have the bootstrap calculation occur between tests. Clean up harness.

Animometer/resources/debug-runner/animometer.js: Run bootstrap after a test has

completed to avoid doing all of it at the end before showing the results. Clean up
parameters being passed around.

Animometer/resources/debug-runner/tests.js:

(text):

Animometer/resources/runner/animometer.js:

(this._processData.calculateScore): Save the results to the same object holding the data.
(this._processData._processData): In the case where a file is dragged, calculate the score
serially. Grab the results object and move it to the results variable and remove it from
the data object. This avoids serializing the results into the JSON.
(this._processData.findRegression): Include the samples used for bootstrapping. Reduce the
resample size to shorten the wait.

Animometer/resources/runner/benchmark-runner.js:
Animometer/resources/statistics.js:

(bootstrap): Update how bootstrapData is sorted. In some regression results the mix of
floats and integers causes an alphabetical sort to occur.

Animometer/resources/strings.js:

Add meta charset so that encodings between harness and test match.

Animometer/tests/bouncing-particles/bouncing-canvas-images.html:
Animometer/tests/bouncing-particles/bouncing-canvas-shapes.html:
Animometer/tests/bouncing-particles/bouncing-css-images.html:
Animometer/tests/bouncing-particles/bouncing-css-shapes.html:
Animometer/tests/bouncing-particles/bouncing-svg-images.html:
Animometer/tests/bouncing-particles/bouncing-svg-shapes.html:
Animometer/tests/master/canvas-stage.html:
Animometer/tests/master/focus.html:
Animometer/tests/master/image-data.html:
Animometer/tests/master/multiply.html:
Animometer/tests/master/particles.html:
Animometer/tests/misc/canvas-electrons.html:
Animometer/tests/misc/canvas-stars.html:
Animometer/tests/misc/compositing-transforms.html:
Animometer/tests/simple/simple-canvas-paths.html:
Animometer/tests/simple/tiled-canvas-image.html:
Animometer/tests/template/template-canvas.html:
Animometer/tests/template/template-css.html:
Animometer/tests/template/template-svg.html:
Animometer/tests/text/layering-text.html:
Animometer/tests/text/text-boxes.html:

Update test harness reporting.

Animometer/developer.html: Add missing meta charset.
Animometer/index.html: Remove unnecessary utf-8 declaration.
Animometer/resources/debug-runner/animometer.css: Add convenience classes for

formatting the results table.

Animometer/resources/debug-runner/animometer.js: Adjust which stats are shown.
Animometer/resources/debug-runner/tests.js: Display bootstrapping statistics.
Animometer/resources/strings.js: Move strings not used by the release harness.

Switch to a pseudo-random number generator.

Animometer/resources/statistics.js: Add a Pseudo class, with a simple

pseudo-random number generator.
(_calculateRegression): Reset the generator before running bootstrap.
(bootstrap): Deleted.

Replace Math.random with Pseudo.random.

Animometer/tests/master/resources/canvas-tests.js:
Animometer/tests/master/resources/focus.js:
Animometer/tests/master/resources/particles.js:
Animometer/tests/resources/main.js:

Use bootstrapping to get confidence interval in the breakpoint.

For the ramp controller, calculate the piecewise regression, and then use
bootstrapping in order to find the 95% confidence interval. Use the raw data.

Animometer/developer.html: Default to the complexity graph. Add a legend

checkbox to toggle visibility of the bootstrap score and histogram.

Animometer/resources/debug-runner/animometer.css: Make some more space to show

the old raw and average scores in the legend. Add new styles for the data.

Animometer/resources/debug-runner/graph.js:

(_addRegressionLine): Allow passing an array for the variance bar tied to the
regression line. Now |stdev| is |range|.
(createComplexityGraph): Add bootstrap median, and overlay a histogram of
the bootstrap samples. Switch raw samples from circles to X's.
(onComplexityGraphOptionsChanged): Allow toggling of the bootstrap data.
(onGraphTypeChanged): Move the regressions for the raw and average samples to the
legend. In the subtitle use the bootstrap median, and include the 95% confidence
interval.

Animometer/resources/runner/animometer.js:

(this._processData.findRegression): Factor out the code that determines which
samples to include when calculating the piecewise regression. For series that have
many samples, or a wider range of recorded complexities, throw away the 2.5%
lowest and highest samples before calculating the regression. Keep all samples
if the number of samples to regress is small or the range of complexities is
narrow.
(this._processData._calculateScore): Factor out regression calculation to
findRegression(). Bootstrap the change point of the regression. The score is the
median.

Animometer/resources/statistics.js:

(_calculateRegression): Correct an issue in the calculation of the regression, where
the denominator can be 0.
(bootstrap): Template for bootstrapping. Create a bootstrap sample array, Create
re-samples by random selection with replacement. Return the 95% confidence samples,
the bootstrap median, mean, and the data itself.

Animometer/resources/strings.js: Add bootstrap.
Animometer/tests/resources/main.js:

(processSamples): Don't prematurely cut the sample data.

Fix graph drawing.

Animometer/resources/debug-runner/animometer.js: Add spacing in the JSON output.

Multiple tests output a lot of JSON and can hang when selecting JSON with no whitespace.

Animometer/resources/debug-runner/animometer.css:

(#complexity-graph .series.raw circle): Update the color.

Animometer/resources/debug-runner/graph.js: Use the FPS axis instead of the

complexity axis, which can vary in domain. For determining the complexity domain,
only use samples after samplingTimeOffset.

Allow dropping results JSON.

Animometer/developer.html: Add a button.
Animometer/resources/debug-runner/animometer.css:
Animometer/resources/debug-runner/animometer.js: Read the data and go straight

to the dashboard. With JSON output, write out only the options and the raw data.

Teach the harness to evaluate the samples and determine the test score.

This will allow us to update how the score is calculated separately from the samples recorded.
This also prepares the harness to be able to accept JSON of prior runs.

Animometer/resources/strings.js: Clean up and remove unneeded strings and reduce some of the

hierarchy.

Animometer/resources/debug-runner/tests.js: Update to use the new strings.

Animometer/tests/resources/main.js: Allow all controllers to show a complexity-FPS graph.

(_processComplexitySamples): Factor out some of the sample processing done in the ramp
controller for the benefit of the other controllers. |complexitySamples| contains a list of
samples. Sort the samples by complexity. Optionally remove the top x% of samples.
Group them, and calculate distribution of samples within the same complexity, and add those as
new entries into |complexityAverageSamples|.
(Controller.processSamples): Move the code responsible for determining the complexity and FPS
scores out to ResultsDashboard. The structure of the data returned by the controller is:

{

controller: [time-regression, time-regression, ...], optional, data specific to controller
marks: [...],
samples: { all of the sample data

controller: [...],
complexity: [...], processed from controller samples
complexityAverage: [...], processed from complexity samples

}

}

(AdaptiveController.processSamples): Adding the target frame length is no longer necessary; we
now pass the test options to the graph.
(Regression): Move to statistics.js.

Animometer/resources/statistics.js: Move Regression to here. Add a check if the sampling range

only contains one sample, since we cannot calculate a regression from one sample point.

Teach the test harness to evaluate the data.

Animometer/resources/runner/animometer.js:

(ResultsDashboard): Store the options used to run the test and the computed results/score separately
from the data. The results are stored as:

{

score: /* geomean of iteration score */,
iterationsResults: [

{

score: /* geomean of tests */,
testsResults: {

suiteName: {

testName: {

controller: {

average:
concern:
stdev:
percent:

},
frameLength: { ... },
complexity: {

complexity:
stdev:
segment1:
segment2:

},
complexityAverage: { ... }

},
testName: { ... },

},
... next suite ...

}

},
{ ...next iteration... }

]

}

Animometer/resources/debug-runner/animometer.js: Pass options around instead of relying

on what was selected in the form. This will later allow for dropping previous results, and
using those runs' options when calculating scores.
(ResultsTable._addGraphButton): Simplify button action by using attached test data.

Animometer/resources/debug-runner/graph.js: Refactor to use the data.

Consolidate JS files, and move statistics out to a separate JS.

Preparation for having the Controller only handle recording and storage of the samples,
and leave the evaluation of the test score out to the harness. Move Experiment to
a new statistics.js, where Regression will also eventually go. Get rid of algorithm.js
and move it to utilities.js since the Heap is used only for Experiments.

Animometer/tests/resources/algorithm.js: Removed. Heap is in utilities.js.
Animometer/tests/resources/sampler.js: Removed. Experiment is in statistics.js,

Sampler in main.js.

Animometer/tests/resources/main.js: Move Sampler here.
Animometer/resources/statistics.js: Added. Move Statistics and Experiment here.
Animometer/resources/extensions.js: Move Heap here. Attach static method to create

a max or min heap to Heap, instead of a new Algorithm object.

Update JS files.

Animometer/developer.html:
Animometer/index.html:
Animometer/tests/bouncing-particles/bouncing-canvas-images.html:
Animometer/tests/bouncing-particles/bouncing-canvas-shapes.html:
Animometer/tests/bouncing-particles/bouncing-css-images.html:
Animometer/tests/bouncing-particles/bouncing-css-shapes.html:
Animometer/tests/bouncing-particles/bouncing-svg-images.html:
Animometer/tests/bouncing-particles/bouncing-svg-shapes.html:
Animometer/tests/master/canvas-stage.html:
Animometer/tests/master/focus.html:
Animometer/tests/master/image-data.html:
Animometer/tests/master/multiply.html:
Animometer/tests/master/particles.html:
Animometer/tests/misc/canvas-electrons.html:
Animometer/tests/misc/canvas-stars.html:
Animometer/tests/misc/compositing-transforms.html:
Animometer/tests/simple/simple-canvas-paths.html:
Animometer/tests/simple/tiled-canvas-image.html:
Animometer/tests/template/template-canvas.html:
Animometer/tests/template/template-css.html:
Animometer/tests/template/template-svg.html:
Animometer/tests/text/layering-text.html:
Animometer/tests/text/text-boxes.html:

Fix the cursor in the graph analysis when the min
complexity is not 0.

Animometer/resources/debug-runner/graph.js:

(_addRegression):
(createComplexityGraph):

6:59 PM Changeset in webkit [197228] by mmaxfield@apple.com

5 edits in trunk

Unreviewed, rolling out r197216.
https://bugs.webkit.org/show_bug.cgi?id=154766

Test simply needs updated result (Requested by litherum on
#webkit).

Reverted changeset:

"Unreviewed, rolling out r197158."
https://bugs.webkit.org/show_bug.cgi?id=154758
http://trac.webkit.org/changeset/197216

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-26

6:53 PM Changeset in webkit [197227] by ap@apple.com

2 edits in trunk/Tools

[iOS Simulator] Reftests don't work
https://bugs.webkit.org/show_bug.cgi?id=154764

Reviewed by Daniel Bates.

Scripts/webkitpy/port/image_diff.py: (IOSSimulatorImageDiffer._start):

Use simctl instead of sim.

6:10 PM Changeset in webkit [197226] by oliver@apple.com

10 edits
1 delete in trunk/Source

Remove the on demand executable allocator
https://bugs.webkit.org/show_bug.cgi?id=154749

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Remove all the DemandExecutable code and executable allocator ifdefs.

CMakeLists.txt:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
JavaScriptCore.xcodeproj/project.pbxproj:
jit/ExecutableAllocator.cpp: Removed.

jit/ExecutableAllocator.h:
jit/ExecutableAllocatorFixedVMPool.cpp:
jit/JITStubRoutine.h:

(JSC::JITStubRoutine::canPerformRangeFilter): Deleted.
(JSC::JITStubRoutine::filteringStartAddress): Deleted.
(JSC::JITStubRoutine::filteringExtentSize): Deleted.

Source/WTF:

Remove the DeamndExecutableAllocator compile flags.

wtf/Platform.h:

6:03 PM Changeset in webkit [197225] by Chris Dumez

9 edits
1 add in trunk

Add API test coverage for parseHTMLInteger / parseHTMLNonNegativeInteger
https://bugs.webkit.org/show_bug.cgi?id=154714

Reviewed by Darin Adler.

Source/WebCore:

Export a couple more symbols for API testing.

html/parser/HTMLParserIdioms.h:

Tools:

Add API test coverage for parseHTMLInteger / parseHTMLNonNegativeInteger as per:

TestWebKitAPI/PlatformEfl.cmake:
TestWebKitAPI/PlatformGTK.cmake:
TestWebKitAPI/PlatformWin.cmake:
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPI.vcxproj:
TestWebKitAPI/TestWebKitAPI.vcxproj/TestWebKitAPI.vcxproj.filters:
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebCore/HTMLParserIdioms.cpp: Added.

(TestWebKitAPI::testParseHTMLInteger):
(TestWebKitAPI::parseHTMLIntegerFails):
(TestWebKitAPI::TEST):
(TestWebKitAPI::testParseHTMLNonNegativeInteger):
(TestWebKitAPI::parseHTMLNonNegativeIntegerFails):

5:47 PM Changeset in webkit [197224] by Ryan Haddad

2 edits in branches/safari-601-branch/LayoutTests

Update TestExpectations for css3/font-variant-* tests. rdar://problem/24190682

platform/mac/TestExpectations:

5:29 PM Changeset in webkit [197223] by achristensen@apple.com

6 edits in trunk/Source/WebKit2

Clear credentials and prevent unauthorized credential storage when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154755

Reviewed by Brady Eidson.

Credentials from previous tests were being used sometimes, notably in
http/tests/misc/401-alternative-content.php when running multiple credential-based
tests with the same WebKitTestRunner.

NetworkProcess/NetworkDataTask.h:
NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::clearCachedCredentials):
(WebKit::NetworkProcess::ensurePrivateBrowsingSession):

NetworkProcess/NetworkSession.h:
NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::NetworkDataTask):
(WebKit::NetworkDataTask::tryPasswordBasedAuthentication):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::NetworkSession::~NetworkSession):
(WebKit::NetworkSession::clearCredentials):
(WebKit::NetworkSession::dataTaskForIdentifier):

5:21 PM Changeset in webkit [197222] by Ryan Haddad

2 edits
1 delete in branches/safari-601-branch/LayoutTests

Remove unnecessary test file and skip fast/text/small-caps-web-font.html on Mavericks. rdar://problem/24748533

platform/mac-mavericks/fast/text/small-caps-web-font-expected.png: Removed.
platform/mac/TestExpectations:

4:59 PM Changeset in webkit [197221] by Ryan Haddad

16 edits
4 deletes in trunk/Source/bmalloc

Unreviewed, rolling out r197174.
https://bugs.webkit.org/show_bug.cgi?id=154762

This change caused LayoutTests to crash on iOS simulator
(Requested by ryanhaddad on #webkit).

Reverted changeset:

"bmalloc: Added a fast XLarge allocator"
https://bugs.webkit.org/show_bug.cgi?id=154720
http://trac.webkit.org/changeset/197174

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-26

4:37 PM Changeset in webkit [197220] by Ryan Haddad

3 edits
3 adds in trunk/LayoutTests

Rebaseline tests for ios-simulator after r197162

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:
platform/ios-simulator/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt:
platform/ios-simulator/imported/w3c/web-platform-tests/html/semantics/selectors/pseudo-classes/indeterminate-radio-expected.txt: Added.

4:15 PM Changeset in webkit [197219] by Beth Dakin

2 edits in trunk/Source/WebCore

32-bit!!!

platform/mac/WebVideoFullscreenInterfaceMac.mm:

(-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):

4:02 PM Changeset in webkit [197218] by Beth Dakin

2 edits in trunk/Source/WebCore

Another 32-bit build fix.

platform/spi/cocoa/AVKitSPI.h:

3:51 PM Changeset in webkit [197217] by Beth Dakin

2 edits in trunk/Source/WebCore

Attempted 32-bit build fix.

platform/mac/WebVideoFullscreenInterfaceMac.mm:

(-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):

3:41 PM Changeset in webkit [197216] by Ryan Haddad

4 edits in trunk

Unreviewed, rolling out r197158.
https://bugs.webkit.org/show_bug.cgi?id=154758

This change did not fix the failing test (Requested by
ryanhaddad on #webkit).

Reverted changeset:

"REGRESSION(r195795): [WK2] fast/text/crash-complex-text-
surrogate.html is flakey"
https://bugs.webkit.org/show_bug.cgi?id=154709
http://trac.webkit.org/changeset/197158

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-26

3:39 PM Changeset in webkit [197215] by Ryan Haddad

12 edits in trunk

Unreviewed, rolling out r197160.
https://bugs.webkit.org/show_bug.cgi?id=154757

This change causes editing/mac/attributed-string/font-
size.html to fail on El Capitan WK1 (Requested by ryanhaddad
on #webkit).

Reverted changeset:

"Font size computed style is innaccurate"
https://bugs.webkit.org/show_bug.cgi?id=154705
http://trac.webkit.org/changeset/197160

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-26

3:33 PM Changeset in webkit [197214] by commit-queue@webkit.org

3 edits in trunk/Source/WTF

Enhance logging: Add "always on" macros
https://bugs.webkit.org/show_bug.cgi?id=154498
<rdar://problem/24757759>

Patch by Keith Rollin <Keith Rollin> on 2016-02-26
Reviewed by Chris Dumez.

Add support for efficient always-on logging (logging that is available
in both debug and release builds). This is implemented in the form of
some new macros:

LOG_ALWAYS: Always log information-level statements.
LOG_ALWAYS_ERROR: Always log error-level statements. These can be filtered out of the normal logging so that they can be found more easily.

In cases where there is no efficient underlying facility for it to
utilize, LOG_ALWAYS_ERROR is redirected to WTFReportError as a backup
mechanism. LOG_ALWAYS is not given a similar treatment so that we
don't overwhelm other logging systems that aren't prepared for "always
on" logging.

wtf/Assertions.h:
wtf/Platform.h:

3:26 PM Changeset in webkit [197213] by barraclough@apple.com

12 edits in trunk/Source

Page TimerAlignmentIntervalIncrease mechanism should have upper limit
https://bugs.webkit.org/show_bug.cgi?id=154744

Reviewed by Geoff Garen.

There would be diminishing returns from throttling timers in background pages infinitely.
Add a heuristic to limit appropriately.

Source/WebCore:

Keep track of the current limit, and make the increase time take this into account.

page/Page.cpp:

(WebCore::Page::setTimerThrottlingEnabled):

When timer throttling is disabled visit all timers to resume.

(WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):

Track the maximum alignment interval, and call setDOMTimerAlignmentInterval to ensure m_timerAlignmentInterval is updated in accordance with the new limit.

(WebCore::Page::setDOMTimerAlignmentInterval):

When the timer alignemnt interval changes update the increase timer.

(WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):

Apply limit.

page/Page.h:

(WebCore::Page::timerThrottlingEnabled):

Accessor for readability.

Source/WebKit2:

The flow of data here is WebPageProxy informs WebProcessPool of the number of pages
participating in this mechanism, WebProcessPool computes an apropriate limit and pushes
this out to the WebProcesses, which in turn update each of their pages.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::WebPageProxy):

Call updateHidenPageThrottingAutoIncreases on creation.

(WebKit::WebPageProxy::updateHidenPageThrottingAutoIncreases):

If increasing timer throttling is enabled increment the counter on WebProcessPool.

(WebKit::WebPageProxy::preferencesDidChange):

Call updateHidenPageThrottingAutoIncreases on preferences change.

UIProcess/WebPageProxy.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::WebProcessPool):

initialize new RefCounter.

(WebKit::WebProcessPool::updateHidenPageThrottingAutoIncreaseLimit):

When count of participating pages changes, update the limit.

UIProcess/WebProcessPool.h:
WebProcess/WebPage/WebPage.h:

(WebKit::WebPage::setHiddenPageTimerThrottlingIncreaseLimit):

Propagate limit to WebCore::Page.

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::setHiddenPageTimerThrottlingIncreaseLimit):

Propagate limit to WebPages.

WebProcess/WebProcess.h:
WebProcess/WebProcess.messages.in:
- Added new message.

3:09 PM Changeset in webkit [197212] by Ryan Haddad

2 edits in trunk/LayoutTests

Skip js/basic-map.html on Mac since it is already run in JSC tests
https://bugs.webkit.org/show_bug.cgi?id=154753

Unreviewed test gardening.

platform/mac/TestExpectations:

3:00 PM Changeset in webkit [197211] by Beth Dakin

2 edits in trunk/Source/WebCore

Attempted build fix.

platform/spi/cocoa/AVKitSPI.h:

2:58 PM Changeset in webkit [197210] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

Reduce direct callers of Structure::findStructuresAndMapForMaterialization
https://bugs.webkit.org/show_bug.cgi?id=154751

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-26
Reviewed by Mark Lam.

runtime/Structure.cpp:

2:56 PM Changeset in webkit [197209] by bshafiei@apple.com

5 edits in tags/Safari-601.5.17.3/Source

Versioning.

2:54 PM Changeset in webkit [197208] by bshafiei@apple.com

1 copy in tags/Safari-601.5.17.3

New tag.

2:51 PM Changeset in webkit [197207] by Beth Dakin

2 edits in trunk/Source/WebKit2

Attempted build fix.

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::setUpVideoControlsManagerWithID):
(WebKit::WebVideoFullscreenManagerProxy::resetMediaState):

2:32 PM Changeset in webkit [197206] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Fix Yosemite build.

UIProcess/API/Cocoa/_WKWebsiteDataSize.mm:

(-[_WKWebsiteDataSize sizeOfDataTypes:]):

2:29 PM Changeset in webkit [197205] by mark.lam@apple.com

130 edits
1 add in trunk

Function.name and Function.length should be configurable.
https://bugs.webkit.org/show_bug.cgi?id=154604

Reviewed by Saam Barati.

Source/JavaScriptCore:

According to https://tc39.github.io/ecma262/#sec-ecmascript-language-functions-and-classes,
"Unless otherwise specified, the name property of a built-in Function object,
if it exists, has the attributes { Writable: false, Enumerable: false,
Configurable: true }."

Similarly, "the length property of a built-in Function object has the attributes
{ Writable: false, Enumerable: false, Configurable: true }."

This patch makes Function.name and Function.length configurable.

We do this by lazily reifying the JSFunction name and length properties on first
access. We track whether each of these properties have been reified using flags
in the FunctionRareData. On first access, if not already reified, we will put
the property into the object with its default value and attributes and set the
reified flag. Thereafter, we rely on the base JSObject to handle access to the
property.

Also, lots of test results have to be re-baselined because the old Function.length
has attribute DontDelete, which is in conflict with the ES6 requirement that it
is configurable.

runtime/FunctionRareData.h:

(JSC::FunctionRareData::hasReifiedLength):
(JSC::FunctionRareData::setHasReifiedLength):
(JSC::FunctionRareData::hasReifiedName):
(JSC::FunctionRareData::setHasReifiedName):

Flags for tracking whether each property has been reified.

runtime/JSFunction.cpp:

(JSC::JSFunction::finishCreation):
(JSC::JSFunction::createBuiltinFunction):

Host and builtin functions currently always reify their name and length properties. Currently, for builtins, the default names that are used may differ from the executable name. For now, we'll stay with keeping this alternate approach to getting the name and length properties for host and builtin functions. However, we need their default attribute to be configurable as well.

(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::getOwnNonIndexPropertyNames):
(JSC::JSFunction::put):
(JSC::JSFunction::deleteProperty):
(JSC::JSFunction::defineOwnProperty):
(JSC::JSFunction::reifyLength):
(JSC::JSFunction::reifyName):
(JSC::JSFunction::reifyLazyPropertyIfNeeded):
(JSC::JSFunction::lengthGetter): Deleted.
(JSC::JSFunction::nameGetter): Deleted.

runtime/JSFunction.h:
runtime/JSFunctionInlines.h:

(JSC::JSFunction::hasReifiedLength):
(JSC::JSFunction::hasReifiedName):

tests/es6.yaml:
4 new passing tests.

tests/mozilla/ecma/Array/15.4.4.3-1.js:
tests/mozilla/ecma/Array/15.4.4.4-1.js:
tests/mozilla/ecma/Array/15.4.4.4-2.js:
tests/mozilla/ecma/GlobalObject/15.1.2.1-1.js:
tests/mozilla/ecma/GlobalObject/15.1.2.2-1.js:
tests/mozilla/ecma/GlobalObject/15.1.2.3-1.js:
tests/mozilla/ecma/GlobalObject/15.1.2.4.js:
tests/mozilla/ecma/GlobalObject/15.1.2.5-1.js:
tests/mozilla/ecma/GlobalObject/15.1.2.6.js:
tests/mozilla/ecma/GlobalObject/15.1.2.7.js:
tests/mozilla/ecma/String/15.5.4.10-1.js:
tests/mozilla/ecma/String/15.5.4.11-1.js:
tests/mozilla/ecma/String/15.5.4.11-5.js:
tests/mozilla/ecma/String/15.5.4.12-1.js:
tests/mozilla/ecma/String/15.5.4.6-2.js:
tests/mozilla/ecma/String/15.5.4.7-2.js:
tests/mozilla/ecma/String/15.5.4.8-1.js:
tests/mozilla/ecma/String/15.5.4.9-1.js:
Rebase expected test results.

tests/stress/function-configurable-properties.js: Added.

LayoutTests:

ietestcenter/Javascript/TestCases/15.2.3.3-4-187.js:

(ES5Harness.registerTest.test):

ietestcenter/Javascript/TestCases/15.3.4.5-15-2.js:

(ES5Harness.registerTest.test):

js/dom/function-name-expected.txt:
js/dom/getOwnPropertyDescriptor-expected.txt:
js/dom/script-tests/function-name.js:
js/mozilla/strict/15.3.5.1-expected.txt:
js/mozilla/strict/function-name-arity-expected.txt:
js/mozilla/strict/script-tests/15.3.5.1.js:
js/mozilla/strict/script-tests/function-name-arity.js:
js/resources/getOwnPropertyDescriptor.js:
sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.6/15.10.6.2_RegExp.prototype.exec/S15.10.6.2_A9.html:
sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.6/15.10.6.3_RegExp.prototype.test/S15.10.6.3_A9.html:
sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.6/15.10.6.4_RegExp.prototype.toString/S15.10.6.4_A9.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.2/15.1.2.1_eval/S15.1.2.1_A4.2.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.2/15.1.2.2_parseInt/S15.1.2.2_A9.2.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.2/15.1.2.3_parseFloat/S15.1.2.3_A7.2.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.2/15.1.2.4_isNaN/S15.1.2.4_A2.2.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.2/15.1.2.5_isFinite/S15.1.2.5_A2.2.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.3/15.1.3.1_decodeURI/S15.1.3.1_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.3/15.1.3.2_decodeURIComponent/S15.1.3.2_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.3/15.1.3.3_encodeURI/S15.1.3.3_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.1_The_Global_Object/15.1.3/15.1.3.4_encodeURIComponent/S15.1.3.4_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.2_Object/15.2.4/15.2.4.2_Object.prototype.toString/S15.2.4.2_A9.html:
sputnik/Conformance/15_Native_Objects/15.2_Object/15.2.4/15.2.4.3_Object.prototype.toLocaleString/S15.2.4.3_A9.html:
sputnik/Conformance/15_Native_Objects/15.2_Object/15.2.4/15.2.4.4_Object.prototype.valueOf/S15.2.4.4_A9.html:
sputnik/Conformance/15_Native_Objects/15.2_Object/15.2.4/15.2.4.5_Object.prototype.hasOwnProperty/S15.2.4.5_A9.html:
sputnik/Conformance/15_Native_Objects/15.2_Object/15.2.4/15.2.4.6_Object.prototype.isPrototypeOf/S15.2.4.6_A9.html:
sputnik/Conformance/15_Native_Objects/15.2_Object/15.2.4/15.2.4.7_Object.prototype.propertyIsEnumerable/S15.2.4.7_A9.html:
sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.4/15.3.4.2_Function.prototype.toString/S15.3.4.2_A9.html:
sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.4/15.3.4.3_Function.prototype.apply/S15.3.4.3_A9.html:
sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.4/15.3.4.4_Function.prototype.call/S15.3.4.4_A9.html:
sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.5/S15.3.5.1_A2_T1.html:
sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.5/S15.3.5.1_A2_T2.html:
sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.5/S15.3.5.1_A2_T3.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.10_Array_prototype_slice/S15.4.4.10_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.11_Array_prototype_sort/S15.4.4.11_A7.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.12_Array_prototype_splice/S15.4.4.12_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.13_Array_prototype_unshift/S15.4.4.13_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.2_Array_prototype_toString/S15.4.4.2_A4.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.3_Array_prototype_toLocaleString/S15.4.4.3_A4.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.4_Array_prototype_concat/S15.4.4.4_A4.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.5_Array_prototype_join/S15.4.4.5_A6.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.6_Array_prototype_pop/S15.4.4.6_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.7_Array_prototype_push/S15.4.4.7_A6.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.8_Array_prototype_reverse/S15.4.4.8_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.9_Array_prototype_shift/S15.4.4.9_A5.2.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.16_String.prototype.toLowerCase/S15.5.4.16_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.17_String.prototype.toLocaleLowerCase/S15.5.4.17_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.18_String.prototype.toUpperCase/S15.5.4.18_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.19_String.prototype.toLocaleUpperCase/S15.5.4.19_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.4_String.prototype.charAt/S15.5.4.4_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.5_String.prototype.charCodeAt/S15.5.4.5_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A9.html:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.9_String.prototype.localeCompare/S15.5.4.9_A9.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.4/15.9.4.2_Date.parse/S15.9.4.2_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.4/15.9.4.3_Date.UTC/S15.9.4.3_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.10_Date.prototype.getFullYear/S15.9.5.10_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.11_Date.prototype.getUTCFullYear/S15.9.5.11_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.12_Date.prototype.getMonth/S15.9.5.12_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.13_Date.prototype.getUTCMonth/S15.9.5.13_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.14_Date.prototype.getDate/S15.9.5.14_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.15_Date.prototype.getUTCDate/S15.9.5.15_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.16_Date.prototype.getDay/S15.9.5.16_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.17_Date.prototype.getUTCDay/S15.9.5.17_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.18_Date.prototype.getHours/S15.9.5.18_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.19_Date.prototype.getUTCHours/S15.9.5.19_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.20_Date.prototype.getMinutes/S15.9.5.20_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.21_Date.prototype.getUTCMinutes/S15.9.5.21_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.22_Date.prototype.getSeconds/S15.9.5.22_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.23_Date.prototype.getUTCSeconds/S15.9.5.23_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.24_Date.prototype.getMilliseconds/S15.9.5.24_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.25_Date.prototype.getUTCMilliseconds/S15.9.5.25_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.26_Date.prototype.getTimezoneOffset/S15.9.5.26_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.27_Date.prototype.setTime/S15.9.5.27_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.28_Date.prototype.setMilliseconds/S15.9.5.28_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.29_Date.prototype.setUTCMilliseconds/S15.9.5.29_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.2_Date.prototype.toString/S15.9.5.2_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.30_Date.prototype.setSeconds/S15.9.5.30_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.31_Date.prototype.setUTCSeconds/S15.9.5.31_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.32_Date.prototype.setMinutes/S15.9.5.32_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.33_Date.prototype.setUTCMinutes/S15.9.5.33_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.34_Date.prototype.setHours/S15.9.5.34_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.35_Date.prototype.setUTCHours/S15.9.5.35_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.36_Date.prototype.setDate/S15.9.5.36_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.37_Date.prototype.setUTCDate/S15.9.5.37_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.38_Date.prototype.setMonth/S15.9.5.38_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.39_Date.prototype.setUTCMonth/S15.9.5.39_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.3_Date.prototype.toDateString/S15.9.5.3_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.40_Date.prototype.setFullYear/S15.9.5.40_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.41_Date.prototype.setUTCFullYear/S15.9.5.41_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.42_Date.prototype.toUTCString/S15.9.5.42_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.4_Date.prototype.toTimeString/S15.9.5.4_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.5_Date.prototype.toLocaleString/S15.9.5.5_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.6_Date.prototype.toLocaleDateString/S15.9.5.6_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.7_Date.prototype.toLocaleTimeString/S15.9.5.7_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.8_Date.prototype.valueOf/S15.9.5.8_A3_T2.html:
sputnik/Conformance/15_Native_Objects/15.9_Date/15.9.5/15.9.5.9_Date.prototype.getTime/S15.9.5.9_A3_T2.html:

2:28 PM Changeset in webkit [197204] by Beth Dakin

24 edits in trunk/Source

Add support for playbackControlsManager
https://bugs.webkit.org/show_bug.cgi?id=154742
-and corresponding-
rdar://problem/23833753

Reviewed by Jer Noble.

Source/WebCore:

Make AVKitSPI.h private so that it can be used from other projects.

WebCore.xcodeproj/project.pbxproj:

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::playInternal):

New function setUpVideoControlsManager.

page/ChromeClient.h:

Make these CoreMedia functions available on Mac and iOS instead of just iOS.

platform/cf/CoreMediaSoftLink.cpp:
platform/cf/CoreMediaSoftLink.h:

This patch fleshes out an implementation for a bunch of these interface
functions since they need to communicate to the playbackControlsManager. This
is also where the playbackControlsManager lives.

platform/mac/WebVideoFullscreenInterfaceMac.h:

Define an interface and implementation for WebPlaybackControlsManager.

platform/mac/WebVideoFullscreenInterfaceMac.mm:

New SPI needed.

platform/spi/cocoa/AVKitSPI.h:
platform/spi/mac/AVFoundationSPI.h:

Source/WebKit2:

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.h:
UIProcess/Cocoa/WebVideoFullscreenManagerProxy.messages.in:
UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::setUpVideoControlsManagerWithID):
(WebKit::WebVideoFullscreenManagerProxy::controlsManagerInterface):

Pipe isPlayingMediaDidChange() to WebViewImpl, and use that information to
update WebViewImplAdditions.

UIProcess/Cocoa/WebViewImpl.h:
UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::isPlayingMediaDidChange):

UIProcess/PageClient.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::isPlayingMediaDidChange):
(WebKit::WebPageProxy::isPlayingVideoWithAudio):

UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::isPlayingAudio):

UIProcess/mac/PageClientImpl.h:
UIProcess/mac/PageClientImpl.mm:

(WebKit::PageClientImpl::isPlayingMediaDidChange):

Pipe setUpVideoControlsManager to the WebVideoFullscreenManager.

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::setUpVideoControlsManager):

WebProcess/WebCoreSupport/WebChromeClient.h:

Ensure the model an interface for the playbackControlsManager on the
WebProcess side and pass the message to the UIProcess to do the same.

WebProcess/cocoa/WebVideoFullscreenManager.h:
WebProcess/cocoa/WebVideoFullscreenManager.mm:

(WebKit::WebVideoFullscreenManager::setUpVideoControlsManager):

2:26 PM Changeset in webkit [197203] by andersca@apple.com

22 edits
5 copies in trunk

WKWebsiteDataStore/WKWebsiteDataRecord needs to provide size information about each type of data
https://bugs.webkit.org/show_bug.cgi?id=154750
Source/WebKit2:

Reviewed by Tim Horton.

DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::fetchWebsiteData):
WebsiteData::Entry now takes a size.

NetworkProcess/NetworkProcess.cpp:

(WebKit::fetchDiskCacheEntries):
If necessary, compute sizes.

(WebKit::NetworkProcess::fetchWebsiteData):
Just pass 0 for the CF cache for now.

NetworkProcess/NetworkProcess.h:
NetworkProcess/NetworkProcess.messages.in:

FetchWebsiteData now takes a OptionSet<WebsiteDataFetchOption>.

Shared/WebsiteData/WebsiteData.cpp:

(WebKit::WebsiteData::Entry::encode):
(WebKit::WebsiteData::Entry::decode):
Encode and decode the size.

Shared/WebsiteData/WebsiteData.h:

Add size.

Shared/WebsiteData/WebsiteDataFetchOption.h:

Add new enum.

UIProcess/API/C/WKApplicationCacheManager.cpp:

(WKApplicationCacheManagerGetApplicationCacheOrigins):
Pass an empty OptionSet<WebsiteDataFetchOption>.

UIProcess/API/C/WKResourceCacheManager.cpp:

(WKResourceCacheManagerGetCacheOrigins):
Pass an empty OptionSet<WebsiteDataFetchOption>.

UIProcess/API/Cocoa/WKWebsiteDataRecord.mm:

(-[WKWebsiteDataRecord description]):
If we have a size, print it out as well.

(-[WKWebsiteDataRecord _dataSize]):
Return a size if we have one.

UIProcess/API/Cocoa/WKWebsiteDataRecordPrivate.h:
UIProcess/API/Cocoa/WKWebsiteDataStore.mm:

(-[WKWebsiteDataStore fetchDataRecordsOfTypes:completionHandler:]):
Call through to the SPI.

(-[WKWebsiteDataStore _fetchDataRecordsOfTypes:withOptions:completionHandler:]):
Compute the right options.

UIProcess/API/Cocoa/WKWebsiteDataStoreInternal.h:

Import WKWebsiteDataStorePrivate.h.

UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:

Add SPI.

UIProcess/API/Cocoa/_WKWebsiteDataSize.h:
UIProcess/API/Cocoa/_WKWebsiteDataSize.mm:

(-[_WKWebsiteDataSize initWithSize:]):
(-[_WKWebsiteDataSize totalSize]):
(-[_WKWebsiteDataSize sizeOfDataTypes:]):
Add _WKWebsiteDataSize header.

UIProcess/API/Cocoa/_WKWebsiteDataSizeInternal.h: Add IPI header.

UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::fetchWebsiteData):
This now takes a OptionSet<WebsiteDataFetchOption>.

UIProcess/Network/NetworkProcessProxy.h:

Update members.

UIProcess/WebsiteData/WebsiteDataRecord.h:

Add a hash map from types to sizes.

UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::WebsiteDataStore::fetchData):
This now takes a OptionSet<WebsiteDataFetchOption>.

UIProcess/WebsiteData/WebsiteDataStore.h:

Update member functions.

WebKit2.xcodeproj/project.pbxproj:

Add new files.

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::fetchWebsiteData):
This now takes a OptionSet<WebsiteDataFetchOption>.

Tools:

rdar://problem/23861395

Reviewed by Tim Horton.

MiniBrowser/mac/WK2BrowserWindowController.m:

(-[WK2BrowserWindowController fetchWebsiteData:]):
Use the new WKWebsiteDataStore SPI to compute data sizes.

2:24 PM Changeset in webkit [197202] by timothy_horton@apple.com

2 edits in branches/safari-601-branch/Source/WTF

Fix the Mavericks build.

wtf/FeatureDefines.h:

This feature flag is fully covered by FeatureDefines.xcconfig,
no need for it here.

2:06 PM Changeset in webkit [197201] by Chris Dumez

3 edits
1 delete in trunk/LayoutTests

Unreviewed, fix flaky test introduced in r197156.

fast/dom/Node/nullable-parameters-expected.txt:
fast/dom/Node/nullable-parameters.html:
fast/dom/Node/resources/testdoc.xml: Removed.
fast/dom/Node/resources/testdoc2.xml: Removed.

1:57 PM Changeset in webkit [197200] by bshafiei@apple.com

2 edits in tags/Safari-601.5.17.2/Source/WebCore

Merge r196703. rdar://problem/24623986

1:55 PM Changeset in webkit [197199] by bshafiei@apple.com

5 edits in tags/Safari-601.5.17.2/Source

Versioning.

1:53 PM Changeset in webkit [197198] by bshafiei@apple.com

1 copy in tags/Safari-601.5.17.2

New tag.

1:51 PM Changeset in webkit [197197] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Add a toWebsiteDataType and reimplement toWebsiteDataTypes using it
https://bugs.webkit.org/show_bug.cgi?id=154746

Reviewed by Sam Weinig.

UIProcess/API/Cocoa/WKWebsiteDataRecordInternal.h:

(WebKit::toWebsiteDataType):
(WebKit::toWebsiteDataTypes):
(WebKit::toWKWebsiteDataTypes):

1:43 PM Changeset in webkit [197196] by keith_miller@apple.com

3 edits in trunk/Source/JavaScriptCore

Folding of OverridesHasInstance DFG nodes shoud happen in constant folding not fixup
https://bugs.webkit.org/show_bug.cgi?id=154743

Reviewed by Mark Lam.

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

1:32 PM Changeset in webkit [197195] by bshafiei@apple.com

7 edits in branches/safari-601-branch/Source/WebCore

Roll out r196637. rdar://problem/24494562

12:58 PM Changeset in webkit [197194] by commit-queue@webkit.org

4 edits
1 add
6 deletes in trunk

<g> wrapping <symbol> causes display of hidden <symbol>
https://bugs.webkit.org/show_bug.cgi?id=154576

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-02-26
Reviewed by Darin Adler.
Source/WebCore:

svg/SVGUseElement.cpp:

(WebCore::disassociateAndRemoveClones): A helper function which removes
cloned SVGElements and their subtrees from their parents and disassociate
them from their originals.

(WebCore::removeDisallowedElementsFromSubtree): Use disassociateAndRemoveClones().

(WebCore::SVGUseElement::cloneTarget): Call removeSymbolElementsFromSubtree()
to remove the descendant SVGSymbolElements from the cloned subtree before
appending it to the container shadow root.

LayoutTests:

Ensure the <symbol> element is not displayed when it's wrapped in a <g>
element and this <g> element is referenced by a <use> element.

platform/gtk/svg/custom/use-on-g-containing-symbol-expected.png: Removed.
platform/gtk/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
platform/ios-simulator/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
platform/mac/svg/custom/use-on-g-containing-symbol-expected.png: Removed.
platform/mac/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
platform/win/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
svg/custom/use-on-g-containing-symbol-expected.svg: Added.
svg/custom/use-on-g-containing-symbol.svg:

The original test was wrong. It had the following definition:

"<g id='symbol'><symbol>...</symbol></g>"

And it was expecting to have the symbol drawn if the <g> element was
referenced like that

"<use xlink:href='#symbol'/>"

12:47 PM Changeset in webkit [197193] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

Initialize LocaleICU data members in header
https://bugs.webkit.org/show_bug.cgi?id=154731

Patch by Olivier Blin <Olivier Blin> on 2016-02-26
Reviewed by Michael Catanzaro.

LocaleICU data members should be initialized in the header, to
avoid conditional initialization lines in the constructor, as
suggested by Darin in bug 154484.

platform/text/LocaleICU.cpp:

(WebCore::LocaleICU::LocaleICU): Deleted.

platform/text/LocaleICU.h:

12:25 PM Changeset in webkit [197192] by keith_miller@apple.com

8 edits
1 add in trunk/Source/JavaScriptCore

Native Typed Array functions should use Symbol.species
https://bugs.webkit.org/show_bug.cgi?id=154569

Reviewed by Michael Saboff.

This patch adds support for Symbol.species in the native Typed Array prototype
functions. Additionally, now that other types of typedarrays are creatable inside
the slice we use the JSGenericTypedArrayView::set function, which has been beefed
up, to put everything into the correct place.

runtime/JSDataView.cpp:

(JSC::JSDataView::set):

runtime/JSDataView.h:
runtime/JSGenericTypedArrayView.h:
runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayViewFromIterator):
(JSC::constructGenericTypedArrayViewWithArguments):
(JSC::constructGenericTypedArrayView):

runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType):
(JSC::JSGenericTypedArrayView<Adaptor>::set):

runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::speciesConstruct):
(JSC::genericTypedArrayViewProtoFuncSet):
(JSC::genericTypedArrayViewProtoFuncSlice):
(JSC::genericTypedArrayViewProtoFuncSubarray):

tests/stress/typedarray-slice.js:

(subclasses.typedArrays.map):
(testSpecies):
(forEach):
(subclasses.forEach):
(testSpeciesRemoveConstructor):
(testSpeciesWithSameBuffer):

tests/stress/typedarray-subarray.js: Added.

(subclasses.typedArrays.map):
(testSpecies):
(forEach):
(subclasses.forEach):
(testSpeciesRemoveConstructor):

11:49 AM Changeset in webkit [197191] by andersca@apple.com

30 edits
1 copy
1 move in trunk/Source

Add WTF::OptionSet and use it for the website data types enum
https://bugs.webkit.org/show_bug.cgi?id=154733

Reviewed by Geoffrey Garen.

Source/WebKit2:

This is a pretty mechanical change:

Convert all uses of the WebsiteDataTypes enum to WTF::OptionSet. Rename the WebsiteDataTypes enum to
WebsiteDataType (since it only represents a single data type), and rename headers. Encode and decode WTF::OptionSet properly.

DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::fetchWebsiteData):
(WebKit::DatabaseProcess::deleteWebsiteData):
(WebKit::DatabaseProcess::deleteWebsiteDataForOrigins):

DatabaseProcess/DatabaseProcess.h:
DatabaseProcess/DatabaseProcess.messages.in:
NetworkProcess/NetworkProcess.cpp:

(WebKit::fetchDiskCacheEntries):
(WebKit::NetworkProcess::fetchWebsiteData):
(WebKit::NetworkProcess::deleteWebsiteData):
(WebKit::NetworkProcess::deleteWebsiteDataForOrigins):

NetworkProcess/NetworkProcess.h:
NetworkProcess/NetworkProcess.messages.in:
Platform/IPC/ArgumentCoders.h:

(IPC::ArgumentCoder<OptionSet<T>>::encode):
(IPC::ArgumentCoder<OptionSet<T>>::decode):

Scripts/webkit/messages.py:

(class_template_headers):

Shared/WebsiteData/WebsiteData.h:
Shared/WebsiteData/WebsiteDataType.h: Renamed from Source/WebKit2/Shared/WebsiteData/WebsiteDataTypes.h.
UIProcess/API/C/WKApplicationCacheManager.cpp:

(WKApplicationCacheManagerGetApplicationCacheOrigins):
(WKApplicationCacheManagerDeleteEntriesForOrigin):
(WKApplicationCacheManagerDeleteAllEntries):

UIProcess/API/C/WKResourceCacheManager.cpp:

(toWebsiteDataTypes):
(WKResourceCacheManagerClearCacheForOrigin):

UIProcess/API/Cocoa/WKWebsiteDataRecordInternal.h:

(WebKit::toWebsiteDataTypes):
(WebKit::toWKWebsiteDataTypes):

UIProcess/Databases/DatabaseProcessProxy.cpp:

(WebKit::DatabaseProcessProxy::fetchWebsiteData):
(WebKit::DatabaseProcessProxy::deleteWebsiteData):
(WebKit::DatabaseProcessProxy::deleteWebsiteDataForOrigins):

UIProcess/Databases/DatabaseProcessProxy.h:
UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::fetchWebsiteData):
(WebKit::NetworkProcessProxy::deleteWebsiteData):
(WebKit::NetworkProcessProxy::deleteWebsiteDataForOrigins):

UIProcess/Network/NetworkProcessProxy.h:
UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::fetchWebsiteData):
(WebKit::WebProcessProxy::deleteWebsiteData):
(WebKit::WebProcessProxy::deleteWebsiteDataForOrigins):

UIProcess/WebProcessProxy.h:
UIProcess/WebsiteData/WebsiteDataRecord.cpp:

(WebKit::WebsiteDataRecord::add):
(WebKit::WebsiteDataRecord::addCookieHostName):
(WebKit::WebsiteDataRecord::addPluginDataHostName):

UIProcess/WebsiteData/WebsiteDataRecord.h:
UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::computeNetworkProcessAccessTypeForDataFetch):
(WebKit::computeWebProcessAccessTypeForDataFetch):
(WebKit::WebsiteDataStore::fetchData):
(WebKit::computeNetworkProcessAccessTypeForDataRemoval):
(WebKit::computeWebProcessAccessTypeForDataRemoval):
(WebKit::WebsiteDataStore::removeData):

UIProcess/WebsiteData/WebsiteDataStore.h:
WebKit2.xcodeproj/project.pbxproj:
WebProcess/WebProcess.cpp:

(WebKit::WebProcess::fetchWebsiteData):
(WebKit::WebProcess::deleteWebsiteData):
(WebKit::WebProcess::deleteWebsiteDataForOrigins):

WebProcess/WebProcess.h:
WebProcess/WebProcess.messages.in:

Source/WTF:

Add WTF::OptionSet which makes it easier to use strong enums as flags.

WTF.xcodeproj/project.pbxproj:
wtf/Forward.h:
wtf/OptionSet.h: Copied from Source/WebKit2/Shared/WebsiteData/WebsiteData.h.

(WTF::OptionSet::fromRaw):
(WTF::OptionSet::OptionSet):
(WTF::OptionSet::toRaw):
(WTF::OptionSet::contains):
(WTF::OptionSet::operator|=):

11:49 AM Changeset in webkit [197190] by beidson@apple.com

4 edits in trunk/Source/WebCore

Modern IDB: Using existing database info from SQLite backing store is busted.
<rdar://problem/24848143> and https://bugs.webkit.org/show_bug.cgi?id=154735

Reviewed by Alex Christensen.

No new tests.

Reproducing the bug requires having a known database on disk *before* launching the DatabaseProcess to
read in the existing IDBDatabaseInfo.

Our automated infrastructure currently has no way of testing this.

Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::openDatabase):

Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo): Do the optional migrate on

the IndexRecords table here; *every* time we open a SQLite backing store.

(WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo): Deleted.

Modules/indexeddb/shared/IDBDatabaseInfo.cpp:

(WebCore::IDBDatabaseInfo::isolatedCopy): Copy the entire object, not just name/version.

11:47 AM Changeset in webkit [197189] by bshafiei@apple.com

8 edits in branches/safari-601-branch/Source

Merge patch for rdar://problem/24826901.

11:45 AM Changeset in webkit [197188] by weinig@apple.com

2 edits in trunk/Source/WebKit2

Try to fix the Yosemite build again.

UIProcess/API/Cocoa/WKUserScript.mm:

(toStringVector):
(-[WKUserScript _initWithSource:injectionTime:forMainFrameOnly:legacyWhitelist:legacyBlacklist:userContentWorld:]):

11:37 AM Changeset in webkit [197187] by mitz@apple.com

2 edits in trunk/Source/WebKit/mac

Build fix for when WK_OVERRIDE_FRAMEWORKS_DIR contains spaces.

Configurations/WebKitLegacy.xcconfig: Added quotes.

11:18 AM Changeset in webkit [197186] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

[JSC] Add32(Imm, Tmp, Tmp) does not ZDef the destination if Imm is zero
https://bugs.webkit.org/show_bug.cgi?id=154704

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-26
Reviewed by Geoffrey Garen.

If the Imm is zero, we should still zero the top bits
to match the definition in AirOpcodes.

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::add32):

b3/testb3.cpp:

11:18 AM Changeset in webkit [197185] by oliver@apple.com

3 edits in trunk/Source/JavaScriptCore

Make testRegExp not crash when given an invalid regexp
https://bugs.webkit.org/show_bug.cgi?id=154732

Reviewed by Mark Lam.

testRegExp.cpp:

(parseRegExpLine):

11:09 AM Changeset in webkit [197184] by bshafiei@apple.com

2 edits in tags/Safari-602.1.20.1/Source/WebCore

Merged r197154. rdar://problem/24845077

10:56 AM Changeset in webkit [197183] by bshafiei@apple.com

5 edits in tags/Safari-602.1.20.1/Source

Versioning.

10:54 AM Changeset in webkit [197182] by weinig@apple.com

2 edits in trunk/Source/WebKit2

Try to fix the Yosemite build.

UIProcess/API/Cocoa/WKUserScriptPrivate.h:

10:51 AM Changeset in webkit [197181] by benjamin@webkit.org

1 edit
1 add in trunk/Source/JavaScriptCore

[JSC] Add the test for r197155
https://bugs.webkit.org/show_bug.cgi?id=154715

Reviewed by Mark Lam.

Silly me. I forgot the test in the latest patch update.

tests/stress/class-syntax-tdz-osr-entry-in-loop.js: Added.

10:44 AM Changeset in webkit [197180] by andersca@apple.com

4 edits in trunk/Source/WebKit2

Cache::traverse should pass the record info to its traversal handler
https://bugs.webkit.org/show_bug.cgi?id=154695

Reviewed by Antti Koivisto.

NetworkProcess/NetworkProcess.cpp:

(WebKit::fetchDiskCacheEntries):
(WebKit::clearDiskCacheEntries):

NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::Cache::traverse):

NetworkProcess/cache/NetworkCache.h:

10:40 AM Changeset in webkit [197179] by bshafiei@apple.com

1 copy in tags/Safari-602.1.20.1

New tag.

10:20 AM Changeset in webkit [197178] by barraclough@apple.com

14 edits in trunk

Source/WebCore:
RefCounter value changed callback should be called on all changes (not just zero edge).
https://bugs.webkit.org/show_bug.cgi?id=154699

Reviewed by Anders Carlsson.

RefCounter currently only triggers a callback when the count goes from zero
to non-zero and vice-versa. Change that, to be useful to more clients.

page/PageThrottler.cpp:

(WebCore::PageThrottler::PageThrottler):

Updated for change in RefCounter callback siganture.

platform/VNodeTracker.cpp:

(WebCore::VNodeTracker::VNodeTracker):

Can now use RefCounter callback to trigger checkPressureState().

(WebCore::VNodeTracker::pressureWarningTimerFired):

RefCounter count is now a size_t (%d -> %ul).

platform/VNodeTracker.h:
- simplified VNodeTracker::token() [no longer needs to call checkPressureState()].

Source/WebKit2:
RefCounter value changed callback should be called on all changes (not just zero edge).
https://bugs.webkit.org/show_bug.cgi?id=154699

Reviewed by Anders Carlsson.

RefCounter currently only triggers a callback when the count goes from zero
to non-zero and vice-versa. Change that, to be useful to more clients.

UIProcess/Plugins/PluginProcessManager.cpp:

(WebKit::PluginProcessManager::PluginProcessManager):

Updated for change in RefCounter callback siganture.

UIProcess/Plugins/PluginProcessManager.h:
- Updated for change in RefCounter callback siganture.
UIProcess/Plugins/mac/PluginProcessManagerMac.mm:

(WebKit::PluginProcessManager::updateProcessSuppressionDisabled):

updated logic for enabling process supression.

UIProcess/ProcessThrottler.cpp:

(WebKit::ProcessThrottler::ProcessThrottler):

Updated for change in RefCounter callback siganture.

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::WebProcessPool):

Updated for change in RefCounter callback siganture.

Source/WTF:
Unreviewed, rolling out r197168.
https://bugs.webkit.org/show_bug.cgi?id=154728

crashing on some devices (Requested by kling on #webkit).

Reverted changeset:

"[Darwin] Use vm_kernel_page_size for WTF::pageSize()."
https://bugs.webkit.org/show_bug.cgi?id=154726
http://trac.webkit.org/changeset/197168

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-26

Tools:
RefCounter value changed callback should be called on all changes (not just zero edge).
https://bugs.webkit.org/show_bug.cgi?id=154699

Reviewed by Geoff Garen.

RefCounter currently only triggers a callback when the count goes from zero
to non-zero and vice-versa. Change that, to be useful to more clients.

TestWebKitAPI/Tests/WTF/RefCounter.cpp:

(TestWebKitAPI::TEST):

Updated for change in RefCounter callback siganture & behaviour.

10:17 AM Changeset in webkit [197177] by akling@apple.com

11 edits
3 deletes in trunk/Source

Remove unused CFNetwork disk cache mmap optimization in WebKit2.
<https://webkit.org/b/154727>

Reviewed by Darin Adler.

Source/WebCore:

Remove some now-unused SPI.

platform/spi/cf/CFNetworkSPI.h:

Source/WebKit2:

Nuke all the code related to the mmap optimization we had for CFNetwork's disk cache.
This code has not been used since we moved to the WebKit2 network cache.

NetworkProcess/Downloads/PendingDownload.h:
NetworkProcess/NetworkLoadClient.h:
NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::sendBufferMaybeAborting): Deleted.

NetworkProcess/NetworkResourceLoader.h:
NetworkProcess/cache/NetworkCacheSpeculativeLoad.h:
NetworkProcess/cocoa/NetworkProcessCocoa.mm:

(WebKit::NetworkProcess::platformLowMemoryHandler): Deleted.
(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa): Deleted.

NetworkProcess/mac/NetworkDiskCacheMonitor.h: Removed.
NetworkProcess/mac/NetworkDiskCacheMonitor.mm: Removed.
NetworkProcess/mac/NetworkLoadMac.mm:

(WebKit::NetworkLoad::willCacheResponseAsync): Deleted.

NetworkProcess/mac/NetworkResourceLoaderMac.mm: Removed.
WebKit2.xcodeproj/project.pbxproj:

10:12 AM Changeset in webkit [197176] by Ryan Haddad

21 edits in trunk

Unreviewed, rolling out r197167.
https://bugs.webkit.org/show_bug.cgi?id=154730

This change broke the Mac build (Requested by ryanhaddad on
#webkit).

Reverted changeset:

"REGRESSION (188611): Search field Cancel button should not
overlap search text on extensions page."
https://bugs.webkit.org/show_bug.cgi?id=154692
http://trac.webkit.org/changeset/197167

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-26

9:58 AM Changeset in webkit [197175] by ggaren@apple.com

4 edits in trunk/PerformanceTests

Fix some issues in MallocBench
https://bugs.webkit.org/show_bug.cgi?id=154600

Reviewed by Oliver Hunt.

MallocBench/MallocBench.xcodeproj/project.pbxproj: Make nimlang.ops

a part of the build so that it copies to the right place for execution.

MallocBench/MallocBench/Interpreter.cpp:

(Interpreter::Interpreter): Don't try to open .ops files for writing
because we're only going to read and we might need extra permissions to
write.

(Interpreter::~Interpreter): Give more context when opening a file fails
to help with debugging.

MallocBench/MallocBench/stress.cpp:

(benchmark_stress): Reduce iterations to complete in less than 10 seconds.

9:57 AM Changeset in webkit [197174] by ggaren@apple.com

16 edits
4 adds in trunk/Source/bmalloc

bmalloc: Added a fast XLarge allocator
https://bugs.webkit.org/show_bug.cgi?id=154720

Reviewed by Andreas Kling.

This is a big speedup for XLarge allocations because it avoids mmap
and page fault churn. It also enables future design changes to handle
a smaller size range on the fast path.

bmalloc.xcodeproj/project.pbxproj:

bmalloc/Algorithm.h:

(bmalloc::roundUpToMultipleOf):
(bmalloc::roundDownToMultipleOf): Added a non-constant round down.

bmalloc/Allocator.cpp:

(bmalloc::Allocator::tryAllocate): XLarge no longer requires the caller
to align things.

(bmalloc::Allocator::allocate): Tweaked the alignment calculation for
clarity. When alignment and largeAlignment are equal, no adjustment
is necessary since all allocations guarantee largeAlignment.

(bmalloc::Allocator::reallocate): Updated for interface change.

Note that the new interface fixes some concurrency bugs. The old code
kept an iterator into the XLarge allocator across lock drop and acquisition,
which is not cool.

(bmalloc::Allocator::allocateXLarge): XLarge no longer requires the caller
to align things.

bmalloc/Heap.cpp:

(bmalloc::Heap::scavengeXLargeObjects): Added scavenging for XLarge.

(bmalloc::Heap::allocateXLarge):

(bmalloc::Heap::splitAndAllocate): Split XLarge objects to xLargeAlignment.

(bmalloc::Heap::tryAllocateXLarge):
(bmalloc::Heap::xLargeSize):
(bmalloc::Heap::shrinkXLarge):
(bmalloc::Heap::deallocateXLarge): Allocate from our map before going
to the OS.

(bmalloc::Heap::findXLarge): Deleted.

bmalloc/Heap.h:

bmalloc/LargeObject.h:

(bmalloc::LargeObject::split):

bmalloc/ObjectType.h:

(bmalloc::isXLarge): Give XLarge objects an explicit alignment for clarity.

bmalloc/Range.h:

(bmalloc::Range::size):
(bmalloc::Range::operator!):
(bmalloc::Range::operator bool):
(bmalloc::Range::operator<):
(bmalloc::canMerge):
(bmalloc::merge): Some helpers that were useful in writing this patch.

bmalloc/Sizes.h:

bmalloc/SortedVector.h: Added.

(bmalloc::SortedVector::Bucket::Bucket):
(bmalloc::SortedVector::Bucket::operator<):
(bmalloc::SortedVector::iterator::iterator):
(bmalloc::SortedVector::iterator::operator++):
(bmalloc::SortedVector::iterator::operator!=):
(bmalloc::SortedVector::iterator::operator*):
(bmalloc::SortedVector::iterator::operator->):
(bmalloc::SortedVector::iterator::skipDeletedBuckets):
(bmalloc::SortedVector::begin):
(bmalloc::SortedVector::end):
(bmalloc::SortedVector<T>::insert):
(bmalloc::SortedVector<T>::find):
(bmalloc::SortedVector<T>::get):
(bmalloc::SortedVector<T>::take):
(bmalloc::SortedVector<T>::shrinkToFit): A simple abstraction for keeping
a sorted vector. Insertion is average amortized log(n) because we keep
deleted buckets that we can reuse.

This is better than a tree because we get better locality, less memory
use, and simpler code. Also, trees require a node memory allocator, and
implementing a memory allocator in a memory allocator is no fun.

Arguably we should use a hash table instead. But that's more code, and
sorted vector has other nice properties that we might want to take
adavantage of in the future.

bmalloc/VMAllocate.h:

(bmalloc::tryVMAllocate): Fixed an inaccuracy in the alignment calculation
here. This code was sort of trying to enforce the alignment that the
XLarge allocator enforces -- but it's better to enforce that alignment
there.

The right calculation is:

vmAlignment - vmPageSize + vmSize

because the worst case is when you are aligned to 0 + vmPageSize, and
you must walk forward vmAlignment - vmPageSize to reach the next
vmAlignment.

(bmalloc::tryVMExtend): Deleted. No need to go back to the OS for VM
since we manage our own.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::allocateLargeChunk): Updated for clarity. When we
grow the large heap we know that grown region is where the next allocation
will take place, so we return it directly instead of pushing it to the
free list.

This fixes a subtle bug where an overly conservative aligned allocation
algorithm can fail to allocate at all when it grows the heap.

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateLargeObject): Ditto.
(bmalloc::VMHeap::allocateLargeObject): Ditto.

bmalloc/VMState.h:

(bmalloc::merge): Added a helper.

bmalloc/Vector.h:

(bmalloc::Vector::begin):
(bmalloc::Vector::end):
(bmalloc::Vector::size):
(bmalloc::Vector::capacity):
(bmalloc::Vector::last):
(bmalloc::Vector::pop):
(bmalloc::Vector<T>::push):
(bmalloc::Vector<T>::pop):
(bmalloc::Vector<T>::shrink): Use a proper iterator API to play nice
with std algorithms.

(bmalloc::Vector<T>::insert): New function required by SortedVector.

(bmalloc::Vector<T>::reallocateBuffer):
(bmalloc::Vector<T>::shrinkCapacity): Allow for shrinking back all the way
to 0 because that's what shrinkToFit wants.
(bmalloc::Vector<T>::growCapacity):
(bmalloc::Vector<T>::shrinkToFit):

bmalloc/XLargeMap.cpp: Added. Helper data structure for managing XLarge

objects. We have enough granularity in our metadata to represent any
kind of address range.

We store free ranges in a flat vector because most programs have very
few individual free XLarge ranges. (They usually merge.)

We store allocated ranges in a sorted vector because programs might
allocate lots of XLarge ranges. For example, if the XLarge minimum is
128kB, and you have a 1GB process, that's 8192 ranges. Linear scan would
examine 8192 items but binary search only 13.

Empirically, this is 1.5X faster than our current large allocator if you
modify MallocBench/big to allocate XLarge objects and not to initialize
objects and you allocate 128kB-256kB objects in a 1GB address space.

(bmalloc::XLargeMap::takeFree): Be careful about overflow in this function
because we support super huge pointers, alignments, and sizes.

(bmalloc::XLargeMap::addFree): Merge eagerly on free because the cost
of missing an XLarge opportunity is catastrophic. Also, I discovered
by experiment that any allocator that doesn't merge eagerly can create
lots of subtle opportunities for snowballing fragmentation, as
fragmentation in range A forces you to chop up range B, and so on.

We allocate "first fit" (allocating the lowest address) because someone
wrote a paper once that said that it's the best algorithm to combat
fragmentation (even though worst case fragmentation is unavoidable
regardless of algorithm).

(bmalloc::XLargeMap::addAllocated):
(bmalloc::XLargeMap::getAllocated):
(bmalloc::XLargeMap::takeAllocated):
(bmalloc::XLargeMap::shrinkToFit):
(bmalloc::XLargeMap::takePhysical):
(bmalloc::XLargeMap::addVirtual):

bmalloc/XLargeMap.h: Added.

(bmalloc::XLargeMap::Allocation::operator<):

bmalloc/XLargeRange.h: Added.

(bmalloc::XLargeRange::XLargeRange):
(bmalloc::XLargeRange::vmState):
(bmalloc::XLargeRange::setVMState):
(bmalloc::canMerge):
(bmalloc::merge):
(bmalloc::XLargeRange::split): Helper for tracking VMState in a range.

9:54 AM Changeset in webkit [197173] by commit-queue@webkit.org

4 edits in trunk/Source

Unreviewed, rolling out r197168.
https://bugs.webkit.org/show_bug.cgi?id=154728

crashing on some devices (Requested by kling on #webkit).

Reverted changeset:

"[Darwin] Use vm_kernel_page_size for WTF::pageSize()."
https://bugs.webkit.org/show_bug.cgi?id=154726
http://trac.webkit.org/changeset/197168

9:50 AM Changeset in webkit [197172] by weinig@apple.com

21 edits
9 adds in trunk

Allow WKUserScripts to be run in isolated worlds
https://bugs.webkit.org/show_bug.cgi?id=154701

Reviewed by Anders Carlsson.

Source/WebKit2:

Adds support for using isolated worlds, called _WKUserContentWorlds in the SPI,
from the UIProcess.

Shared/API/APIObject.h:
Shared/Cocoa/APIObject.mm:
UIProcess/API/APIUserContentWorld.cpp: Added.

(API::generateIdentifier):
(API::UserContentWorld::worldWithName):
(API::UserContentWorld::normalWorld):
(API::UserContentWorld::UserContentWorld):
(API::UserContentWorld::~UserContentWorld):

UIProcess/API/APIUserContentWorld.h: Added.

Add new UserContentWorld type.

UIProcess/API/APIUserScript.h:

Bind each user script to a particular _WKUserContentWorld.

UIProcess/API/C/WKUserScriptRef.cpp:

(WKUserScriptCreateWithSource):
(WKUserScriptCopySource):
Existing APIs create user scripts for the normal world, preserving existing behavior.

UIProcess/API/Cocoa/WKUserScript.mm:

(-[WKUserScript initWithSource:injectionTime:forMainFrameOnly:]):
Existing APIs create user scripts for the normal world, preserving existing behavior.

(-[WKUserScript _initWithSource:injectionTime:forMainFrameOnly:legacyWhitelist:legacyBlacklist:userContentWorld:]):
Add a new initializer which takes a world to bind to. Also add support for the legacy whitelist/blacklist mechanism
while we are here, as the expected client needs these as well.

(-[WKUserScript _userContentWorld]):
Add accessor for the bound world.

UIProcess/API/Cocoa/WKUserScriptInternal.h:
UIProcess/API/Cocoa/WKUserScriptPrivate.h: Added.

Add new private header.

UIProcess/API/Cocoa/_WKUserContentWorld.h: Added.
UIProcess/API/Cocoa/_WKUserContentWorld.mm: Added.

(+[_WKUserContentWorld worldWithName:]):
(+[_WKUserContentWorld normalWorld]):
(-[_WKUserContentWorld dealloc]):
(-[_WKUserContentWorld name]):
(-[_WKUserContentWorld _apiObject]):

UIProcess/API/Cocoa/_WKUserContentWorldInternal.h: Added.

Add SPI wrapper.

UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::addProcess):
(WebKit::WebUserContentControllerProxy::addUserScript):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::removeAllUserScripts):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):

UIProcess/UserContent/WebUserContentControllerProxy.h:

(WebKit::WebUserContentControllerProxy::userScripts):
(WebKit::WebUserContentControllerProxy::userStyleSheets):
Add support for registering the worlds with the associated WebContentProcesses and then using
their identifiers to map user scripts to the correct world.

WebKit2.xcodeproj/project.pbxproj:

Add new files.

WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInScriptWorld.h:
WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInScriptWorld.mm:

(-[WKWebProcessPlugInScriptWorld name]):
Expose the name property.

WebProcess/InjectedBundle/API/c/WKBundleScriptWorld.cpp:

(WKBundleScriptWorldCopyName):

WebProcess/InjectedBundle/API/c/WKBundleScriptWorld.h:

Expose the name property.

WebProcess/InjectedBundle/InjectedBundleScriptWorld.cpp:

(WebKit::allWorlds):
(WebKit::InjectedBundleScriptWorld::create):
(WebKit::InjectedBundleScriptWorld::getOrCreate):
(WebKit::InjectedBundleScriptWorld::normalWorld):
(WebKit::InjectedBundleScriptWorld::InjectedBundleScriptWorld):
(WebKit::InjectedBundleScriptWorld::~InjectedBundleScriptWorld):
(WebKit::InjectedBundleScriptWorld::coreWorld):
(WebKit::InjectedBundleScriptWorld::clearWrappers):

WebProcess/InjectedBundle/InjectedBundleScriptWorld.h:

(WebKit::InjectedBundleScriptWorld::name):
Add the name property and do some drive-by RefPtr -> Ref conversions.

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::userContentControllers):
(WebKit::worldMap):
(WebKit::WebUserContentController::getOrCreate):
(WebKit::WebUserContentController::~WebUserContentController):
(WebKit::WebUserContentController::addUserContentWorlds):
(WebKit::WebUserContentController::removeUserContentWorld):
(WebKit::WebUserContentController::addUserScripts):
(WebKit::WebUserContentController::removeUserScript):
(WebKit::WebUserContentController::removeAllUserScripts):
(WebKit::WebUserContentController::addUserStyleSheets):

WebProcess/UserContent/WebUserContentController.h:
WebProcess/UserContent/WebUserContentController.messages.in:

Track and use worlds passed from the UIProcess.

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/_WKUserContentWorld.mm: Added.

(-[SimpleDelegate webView:didFinishNavigation:]):
(-[UserContentWorldRemoteObject didObserveNormalWorld]):
(-[UserContentWorldRemoteObject didObserveWorldWithName:]):

TestWebKitAPI/Tests/WebKit2Cocoa/_WKUserContentWorldPlugIn.mm: Added.

(-[_WKUserContentWorldPlugIn webProcessPlugIn:didCreateBrowserContextController:]):
(-[_WKUserContentWorldPlugIn webProcessPlugInBrowserContextController:globalObjectIsAvailableForFrame:inScriptWorld:]):

TestWebKitAPI/Tests/WebKit2Cocoa/_WKUserContentWorldProtocol.h: Added.

9:36 AM Changeset in webkit [197171] by commit-queue@webkit.org

6 edits in trunk/Source/WebCore

Remove libqcms support
https://bugs.webkit.org/show_bug.cgi?id=154707

Patch by Martin Robinson <mrobinson@igalia.com> on 2016-02-26
Reviewed by Žan Doberšek.

No new tests. This change simply removes dead code.

platform/image-decoders/ImageDecoder.h: Remove QCMS support.

(WebCore::ImageDecoder::qcmsOutputDeviceProfile): Deleted.

platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Remove QCMS support.

(WebCore::JPEGImageReader::JPEGImageReader): Deleted.
(WebCore::JPEGImageReader::close): Deleted.
(WebCore::JPEGImageReader::decode): Deleted.
(WebCore::JPEGImageReader::colorTransform): Deleted.
(WebCore::JPEGImageReader::createColorTransform): Deleted.
(WebCore::JPEGImageDecoder::outputScanlines): Deleted.

platform/image-decoders/png/PNGImageDecoder.cpp: Remove QCMS support.

(WebCore::PNGImageReader::PNGImageReader): Deleted.
(WebCore::PNGImageReader::close): Deleted.
(WebCore::PNGImageReader::rowBuffer): Deleted.
(WebCore::PNGImageReader::createRowBuffer): Deleted.
(WebCore::PNGImageReader::colorTransform): Deleted.
(WebCore::PNGImageReader::createColorTransform): Deleted.
(WebCore::PNGImageDecoder::headerAvailable): Deleted.
(WebCore::PNGImageDecoder::rowAvailable): Deleted.
(WebCore::PNGImageDecoder::frameComplete): Deleted.

platform/image-decoders/webp/WEBPImageDecoder.cpp: Remove QCMS support.

(WebCore::WEBPImageDecoder::decode): Remove QCMS support.
(WebCore::WEBPImageDecoder::WEBPImageDecoder): Deleted.
(WebCore::WEBPImageDecoder::clear): Deleted.
(WebCore::WEBPImageDecoder::createColorTransform): Deleted.
(WebCore::WEBPImageDecoder::readColorProfile): Deleted.
(WebCore::WEBPImageDecoder::applyColorProfile): Deleted.

platform/image-decoders/webp/WEBPImageDecoder.h: Remove QCMS support.

(WebCore::WEBPImageDecoder::colorTransform): Deleted.

9:36 AM Changeset in webkit [197170] by Alan Bujtas

8 edits in trunk/Source/WebCore

RenderTheme::controlSize* methods should take const RenderStyle&.
https://bugs.webkit.org/show_bug.cgi?id=154708

Reviewed by Darin Adler.

No change in functionality.

rendering/RenderTheme.h:

(WebCore::RenderTheme::minimumMenuListSize):
(WebCore::RenderTheme::popupInternalPaddingLeft):
(WebCore::RenderTheme::popupInternalPaddingRight):
(WebCore::RenderTheme::popupInternalPaddingTop):
(WebCore::RenderTheme::popupInternalPaddingBottom):

rendering/RenderThemeMac.h:
rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::controlSizeForFont):
(WebCore::RenderThemeMac::sizeForFont):
(WebCore::RenderThemeMac::sizeForSystemFont):
(WebCore::RenderThemeMac::controlSizeForSystemFont):
(WebCore::RenderThemeMac::minimumProgressBarHeight):
(WebCore::RenderThemeMac::popupInternalPaddingLeft):
(WebCore::RenderThemeMac::popupInternalPaddingRight):
(WebCore::RenderThemeMac::popupInternalPaddingTop):
(WebCore::RenderThemeMac::popupInternalPaddingBottom):
(WebCore::RenderThemeMac::minimumMenuListSize):

9:15 AM Changeset in webkit [197169] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Option-clicking on the a CSS property sometimes doesn't work
https://bugs.webkit.org/show_bug.cgi?id=154384
<rdar://problem/24714755>

Patch by Devin Rousso <Devin Rousso> on 2016-02-26
Reviewed by Timothy Hatcher.

UserInterface/Controllers/CodeMirrorTokenTrackingController.js:

(WebInspector.CodeMirrorTokenTrackingController.prototype._hidePopover):

9:04 AM Changeset in webkit [197168] by akling@apple.com

4 edits in trunk/Source

[Darwin] Use vm_kernel_page_size for WTF::pageSize().
<https://webkit.org/b/154726>

Reviewed by Antti Koivisto.

Source/WebKit2:

Use WTF::pageSize() for the SharedMemory page size.

Platform/mac/SharedMemoryMac.cpp:

(WebKit::SharedMemory::systemPageSize):

Source/WTF:

Make sure we use the right VM page size on Darwin systems.
On devices where the native page size is 4 KB, it's both
possible and profitable to madvise in smaller chunks.

wtf/PageBlock.cpp:

(WTF::systemPageSize):

9:00 AM Changeset in webkit [197167] by Alan Bujtas

21 edits in trunk

REGRESSION (188611): Search field Cancel button should not overlap search text on extensions page.
https://bugs.webkit.org/show_bug.cgi?id=154692
<rdar://problem/22840453>

Reviewed by Brent Fulgham.

Adjust the cancel button position using the actual size of the cancel button.

Covered by existing tests.

Source/WebCore:

rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::paintSearchFieldCancelButton):
(WebCore::RenderThemeMac::cancelButtonSizes): Update button size.

LayoutTests:

fast/forms/search/search-padding-cancel-results-buttons-expected.txt:
platform/mac/fast/css/focus-ring-exists-for-search-field-expected.txt:
platform/mac/fast/css/text-input-with-webkit-border-radius-expected.txt:
platform/mac/fast/css/text-overflow-input-expected.txt:
platform/mac/fast/forms/box-shadow-override-expected.txt:
platform/mac/fast/forms/control-restrict-line-height-expected.txt:
platform/mac/fast/forms/input-appearance-height-expected.txt:
platform/mac/fast/forms/placeholder-position-expected.txt:
platform/mac/fast/forms/placeholder-pseudo-style-expected.txt:
platform/mac/fast/forms/search-cancel-button-style-sharing-expected.txt:
platform/mac/fast/forms/search-display-none-cancel-button-expected.txt:
platform/mac/fast/forms/search-rtl-expected.txt:
platform/mac/fast/forms/search-styled-expected.txt:
platform/mac/fast/forms/search-vertical-alignment-expected.txt:
platform/mac/fast/forms/search/search-size-with-decorations-expected.txt:
platform/mac/fast/forms/searchfield-heights-expected.txt:
platform/mac/fast/repaint/search-field-cancel-expected.txt:
platform/mac/fast/replaced/width100percent-searchfield-expected.txt:

8:47 AM Changeset in webkit [197166] by commit-queue@webkit.org

4 edits in trunk/Source/WebKit

[cmake] Moved WebKit/Storage sources and include dir to CMakeLists.txt.
https://bugs.webkit.org/show_bug.cgi?id=154722

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-26
Reviewed by Darin Adler.

This code provides port-independent layer used by all WK1 ports,
so it belongs to main CMakeLists.txt, not Platform files.

CMakeLists.txt:
PlatformMac.cmake:
PlatformWin.cmake:

6:57 AM Changeset in webkit [197165] by Antti Koivisto

16 edits
2 adds in trunk

Implement ::slotted pseudo element
https://bugs.webkit.org/show_bug.cgi?id=149441
<rdar://problem/22731987>

Reviewed by Andreas Kling.

Source/WebCore:

Based on latest in https://github.com/w3c/webcomponents/issues/331

css/CSSGrammar.y.in:

Parse ::slotted.

css/CSSParser.cpp:

(WebCore::CSSParser::detectFunctionTypeToken):

css/CSSParserValues.cpp:

(WebCore::CSSParserSelector::parsePseudoElementCueFunctionSelector):
(WebCore::CSSParserSelector::parsePseudoElementSlottedFunctionSelector):

Tokenize ::slotted.

(WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):

css/CSSParserValues.h:
css/CSSSelector.cpp:

(WebCore::CSSSelector::pseudoId):

css/CSSSelector.h:
css/ElementRuleCollector.cpp:

(WebCore::ElementRuleCollector::matchAuthorRules):
(WebCore::ElementRuleCollector::matchHostPseudoClassRules):
(WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):

Match ::slotted selector.

(WebCore::ElementRuleCollector::collectSlottedPseudoElementRulesForSlot):

Collect ::slotted rules that may apply to an element in a slot.

(WebCore::ElementRuleCollector::matchUserRules):
(WebCore::ElementRuleCollector::matchUARules):
(WebCore::findSlottedPseudoElementSelector):
(WebCore::ElementRuleCollector::ruleMatches):

css/ElementRuleCollector.h:
css/RuleSet.cpp:

(WebCore::RuleSet::addRule):

Collect ::slotted rules.

(WebCore::RuleSet::shrinkToFit):

css/RuleSet.h:

(WebCore::RuleSet::hostPseudoClassRules):
(WebCore::RuleSet::slottedPseudoElementRules):
(WebCore::RuleSet::focusPseudoClassRules):
(WebCore::RuleSet::universalRules):

css/SelectorChecker.cpp:

(WebCore::SelectorChecker::checkOne):

style/StyleSharingResolver.cpp:

(WebCore::Style::SharingResolver::resolve):

Disable style sharing for children of shadow host. They may be affected by the shadow tree style
which is not considered in style sharing checks.

LayoutTests:

fast/shadow-dom/css-scoping-shadow-slotted-rule.html:

Enable the test, fix it and update it to the current spec.

fast/shadow-dom/slotted-pseudo-element-css-text-expected.txt: Added.
fast/shadow-dom/slotted-pseudo-element-css-text.html: Added.

Add parsing/cssText test based on a Blink test.
There are a few failures due to * not roundtripping and the parser being too lenient with pseudo elements.

platform/mac/TestExpectations:

3:49 AM Changeset in webkit [197164] by Yusuke Suzuki

2 edits in trunk/Source/JavaScriptCore

[DFG] Drop unnecessary proved type branch in ToPrimitive
https://bugs.webkit.org/show_bug.cgi?id=154716

Reviewed by Geoffrey Garen.

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

2:10 AM Changeset in webkit [197163] by youenn.fablet@crf.canon.fr

3 edits in trunk/Tools

W3C test importer should have an option to clean the destination directory
https://bugs.webkit.org/show_bug.cgi?id=152685

Reviewed by Darin Adler.

Adding --clean-dest-dir option to W3C test importer.
When this option is set, all files in the destination directory will be deleted
except for WebKit specific files (test expectations, .gitignore...) before new tests import.
Dangling test expectations are removed after tests import.'

Adding unit test and minor refactoring for the other tests.

Scripts/webkitpy/w3c/test_importer.py:

(parse_args): Add '--clean-dest-dir' option.
(TestImporter.do_import):
(TestImporter._is_baseline): helper routine to capture -expected.txt files.
(TestImporter):
(TestImporter._should_not_keep_when_importing): helper routine to filter files that should not be cleaned before importing.
(TestImporter.clean_destination_directory):
(TestImporter.remove_dangling_expectations):

Scripts/webkitpy/w3c/test_importer_unittest.py:

(TestImporterTest._parse_options):
(TestImporterTest.test_import_dir_with_no_tests_and_no_hg):
(TestImporterTest.test_import_dir_with_no_tests):
(TestImporterTest.test_import_dir_with_empty_init_py):
(test_clean_directory_option):

12:55 AM Changeset in webkit [197162] by youenn.fablet@crf.canon.fr

83 edits
8 copies
15 moves
53 adds
1 delete in trunk/LayoutTests

Sync web-platform-tests up to revision 5ca8b46
https://bugs.webkit.org/show_bug.cgi?id=154678

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

resources/ImportExpectations: Unskipped some tests (already imported tests) and skipped new tests added to WPT repo.
resources/TestRepositories: Update revision to 5ca8b46.
resources/web-platform-tests-modules.json:
web-platform-tests/XMLHttpRequest/FormData-append-expected.txt:
web-platform-tests/XMLHttpRequest/FormData-append.html:
web-platform-tests/XMLHttpRequest/OWNERS: Added.
web-platform-tests/XMLHttpRequest/event-readystate-sync-open-expected.txt: Added.
web-platform-tests/XMLHttpRequest/event-readystate-sync-open.htm: Added.
web-platform-tests/XMLHttpRequest/formdata-delete-expected.txt: Added.
web-platform-tests/XMLHttpRequest/formdata-delete.htm: Added.
web-platform-tests/XMLHttpRequest/formdata-get-expected.txt: Added.
web-platform-tests/XMLHttpRequest/formdata-get.htm: Added.
web-platform-tests/XMLHttpRequest/formdata-has-expected.txt: Added.
web-platform-tests/XMLHttpRequest/formdata-has.htm: Added.
web-platform-tests/XMLHttpRequest/formdata-set-expected.txt: Added.
web-platform-tests/XMLHttpRequest/formdata-set.htm: Added.
web-platform-tests/XMLHttpRequest/interfaces-expected.txt:
web-platform-tests/XMLHttpRequest/open-method-responsetype-set-sync-expected.txt:
web-platform-tests/XMLHttpRequest/open-method-responsetype-set-sync.htm:
web-platform-tests/XMLHttpRequest/open-url-encoding-expected.txt:
web-platform-tests/XMLHttpRequest/open-url-encoding.htm:
web-platform-tests/XMLHttpRequest/responsexml-document-properties-expected.txt:
web-platform-tests/XMLHttpRequest/responsexml-document-properties.htm:
web-platform-tests/XMLHttpRequest/responsexml-get-twice-expected.txt: Added.
web-platform-tests/XMLHttpRequest/responsexml-get-twice.htm: Added.
web-platform-tests/XMLHttpRequest/send-entity-body-document-expected.txt:
web-platform-tests/XMLHttpRequest/w3c-import.log:
web-platform-tests/common/OWNERS: Added.
web-platform-tests/common/w3c-import.log:
web-platform-tests/dom/OWNERS: Added.
web-platform-tests/dom/interfaces-expected.txt:
web-platform-tests/dom/nodes/Document-createElement-namespace-tests/empty.html: Added.
web-platform-tests/dom/nodes/Document-createElement-namespace-tests/empty.svg: Added.
web-platform-tests/dom/nodes/Document-createElement-namespace-tests/empty.xhtml: Added.
web-platform-tests/dom/nodes/Document-createElement-namespace-tests/empty.xml: Added.
web-platform-tests/dom/nodes/Document-createEvent-expected.txt:
web-platform-tests/dom/nodes/Document-createEvent.html:
web-platform-tests/dom/nodes/MutationObserver-childList-expected.txt:
web-platform-tests/dom/nodes/Node-isEqualNode-expected.txt:
web-platform-tests/dom/w3c-import.log:
web-platform-tests/domparsing/DOMParser-parseFromString-html-expected.txt:
web-platform-tests/domparsing/OWNERS: Added.
web-platform-tests/domparsing/w3c-import.log:
web-platform-tests/fetch/OWNERS: Added.
web-platform-tests/fetch/api/headers/headers-combine-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/fetch/api/headers/headers-nameshake-expected.txt.
web-platform-tests/fetch/api/headers/headers-combine.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/fetch/api/headers/headers-nameshake.html.
web-platform-tests/fetch/api/headers/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log.
web-platform-tests/fetch/api/request/request-clone.sub.html:
web-platform-tests/fetch/api/request/request-consume.html:
web-platform-tests/fetch/api/request/request-error-expected.txt:
web-platform-tests/fetch/api/request/request-error.html:
web-platform-tests/fetch/api/request/request-idl-expected.txt:
web-platform-tests/fetch/api/request/request-init-001.sub-expected.txt:
web-platform-tests/fetch/api/request/request-init-001.sub.html:
web-platform-tests/fetch/api/request/request-init-003.sub.html:
web-platform-tests/fetch/api/request/w3c-import.log: Added.
web-platform-tests/fetch/api/resources/method.py:

(main):

web-platform-tests/fetch/api/resources/utils.js:

(checkRequest):
(readTextStream):

web-platform-tests/fetch/api/resources/w3c-import.log: Added.
web-platform-tests/fetch/api/response/response-clone.html:
web-platform-tests/fetch/api/response/response-consume.html:
web-platform-tests/fetch/api/response/response-error-expected.txt:
web-platform-tests/fetch/api/response/response-error.html:
web-platform-tests/fetch/api/response/response-idl-expected.txt:
web-platform-tests/fetch/api/response/response-idl.html:
web-platform-tests/fetch/api/response/response-init-002.html:
web-platform-tests/fetch/api/response/response-static-error.html:
web-platform-tests/fetch/api/response/response-static-redirect-expected.txt:
web-platform-tests/fetch/api/response/response-static-redirect.html:
web-platform-tests/fetch/api/response/w3c-import.log: Added.
web-platform-tests/fetch/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/w3c-import.log.
web-platform-tests/html/OWNERS: Added.
web-platform-tests/html/dom/interfaces-expected.txt:
web-platform-tests/html/dom/interfaces.html:
web-platform-tests/html/dom/w3c-import.log:
web-platform-tests/html/semantics/document-metadata/the-base-element/base_multiple.html:
web-platform-tests/html/semantics/embedded-content/media-elements/historical-expected.txt:
web-platform-tests/html/semantics/embedded-content/media-elements/historical.html:
web-platform-tests/html/semantics/embedded-content/the-area-element/area-coords-expected.txt: Added.
web-platform-tests/html/semantics/embedded-content/the-area-element/area-coords.html: Added.
web-platform-tests/html/semantics/embedded-content/the-embed-element/embed-document-expected.txt: Added.
web-platform-tests/html/semantics/embedded-content/the-embed-element/embed-document.html: Added.
web-platform-tests/html/semantics/embedded-content/the-embed-element/embed-iframe-expected.txt: Added.
web-platform-tests/html/semantics/embedded-content/the-embed-element/embed-iframe.html: Added.
web-platform-tests/html/semantics/embedded-content/the-embed-element/w3c-import.log:
web-platform-tests/html/semantics/embedded-content/the-img-element/update-media-expected.txt: Added.
web-platform-tests/html/semantics/embedded-content/the-img-element/update-media.html: Added.
web-platform-tests/html/semantics/embedded-content/the-img-element/w3c-import.log:
web-platform-tests/html/semantics/forms/textfieldselection/w3c-import.log:
web-platform-tests/html/semantics/forms/the-input-element/checkbox.html:
web-platform-tests/html/semantics/forms/the-input-element/radio.html:
web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt:
web-platform-tests/html/semantics/forms/the-input-element/type-change-state.html:
web-platform-tests/html/semantics/selectors/pseudo-classes/indeterminate-radio-expected.txt: Added.
web-platform-tests/html/semantics/selectors/pseudo-classes/indeterminate-radio.html: Added.
web-platform-tests/html/semantics/selectors/pseudo-classes/w3c-import.log:
web-platform-tests/html/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/w3c-import.log.
web-platform-tests/images/OWNERS: Added.
web-platform-tests/images/w3c-import.log:
web-platform-tests/lint.whitelist:
web-platform-tests/media/OWNERS: Added.
web-platform-tests/media/w3c-import.log:
web-platform-tests/service-workers/OWNERS: Added.
web-platform-tests/service-workers/cache-storage/OWNERS: Added.
web-platform-tests/service-workers/cache-storage/resources/credentials-iframe.html: Added.
web-platform-tests/service-workers/cache-storage/resources/credentials-worker.js: Added.

(assert_equals):
(self.onfetch):
(self.onmessage):

web-platform-tests/service-workers/cache-storage/resources/test-helpers.js:

(response.new.Response):
(assert_response_equals):
(assert_response_array_equivalent):
(assert_response_array_equals):
(assert_response_in_array):

web-platform-tests/service-workers/cache-storage/resources/testharness-helpers.js:
web-platform-tests/service-workers/cache-storage/resources/w3c-import.log:
web-platform-tests/service-workers/cache-storage/script-tests/cache-add.js:

(cache_test):

web-platform-tests/service-workers/cache-storage/script-tests/cache-match.js:

(request.new.Request.entries.a.request.clone):
(return.cache.match.entries.non_2xx_response.request.url.then):
(return.cache.match.entries.error_response.request.url.then):
(return.cache.match.string_appeared_here.then): Deleted.
(return.cache.match.entries.a.request.url.then): Deleted.
(return.cache.match.entries.a.request.then): Deleted.
(return.cache.match.new.Request.entries.a.request.url.then): Deleted.
(then): Deleted.
(return.cache.match.entries.cat.request.url.string_appeared_here.then): Deleted.
(cache_test): Deleted.
(return.cache.match.request.then): Deleted.

web-platform-tests/service-workers/cache-storage/script-tests/cache-matchAll.js: Added.

(return.cache.matchAll.string_appeared_here.then):
(return.cache.matchAll.entries.a.request.url.then):
(return.cache.matchAll.entries.a.request.then):
(return.cache.matchAll.new.Request.entries.a.request.url.then):
(then):
(return.cache.matchAll.entries.cat.request.url.string_appeared_here.then):

web-platform-tests/service-workers/cache-storage/script-tests/cache-put.js:

(cache_test):

web-platform-tests/service-workers/cache-storage/script-tests/cache-storage.js:

(promise_test):

web-platform-tests/service-workers/cache-storage/script-tests/w3c-import.log:
web-platform-tests/service-workers/cache-storage/serviceworker/cache-match.https.html:
web-platform-tests/service-workers/cache-storage/serviceworker/cache-matchAll.https.html: Copied from LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/serviceworker/cache-match.https.html.
web-platform-tests/service-workers/cache-storage/serviceworker/credentials.html: Added.
web-platform-tests/service-workers/cache-storage/serviceworker/w3c-import.log:
web-platform-tests/service-workers/cache-storage/w3c-import.log:
web-platform-tests/service-workers/cache-storage/window/cache-match.https.html:
web-platform-tests/service-workers/cache-storage/window/cache-matchAll.https.html: Copied from LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/window/cache-match.https.html.
web-platform-tests/service-workers/cache-storage/window/w3c-import.log:
web-platform-tests/service-workers/cache-storage/worker/cache-match.https.html:
web-platform-tests/service-workers/cache-storage/worker/cache-matchAll.https.html: Copied from LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/worker/cache-match.https.html.
web-platform-tests/service-workers/cache-storage/worker/w3c-import.log:
web-platform-tests/service-workers/w3c-import.log:
web-platform-tests/streams/README.txt: Removed.
web-platform-tests/streams/byte-length-queuing-strategy.https-expected.txt: Added.
web-platform-tests/streams/byte-length-queuing-strategy.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/byte-length-queuing-strategy.html.
web-platform-tests/streams/byte-length-queuing-strategy.js:

(test):

web-platform-tests/streams/count-queuing-strategy.https-expected.txt: Added.
web-platform-tests/streams/count-queuing-strategy.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/count-queuing-strategy.html.
web-platform-tests/streams/count-queuing-strategy.js:

(test):

web-platform-tests/streams/readable-streams/bad-strategies.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/bad-strategies.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/bad-strategies.html.
web-platform-tests/streams/readable-streams/bad-strategies.js:

(get string_appeared_here):
(test):
(promise_test):

web-platform-tests/streams/readable-streams/bad-underlying-sources.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/bad-underlying-sources.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/bad-underlying-sources.html.
web-platform-tests/streams/readable-streams/brand-checks.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/brand-checks.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/brand-checks.html.
web-platform-tests/streams/readable-streams/cancel.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/cancel.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/cancel.html.
web-platform-tests/streams/readable-streams/count-queuing-strategy-integration.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/count-queuing-strategy-integration.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/count-queuing-strategy-integration.html.
web-platform-tests/streams/readable-streams/garbage-collection.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/garbage-collection.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/garbage-collection.html.
web-platform-tests/streams/readable-streams/general.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/general.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/general.html.
web-platform-tests/streams/readable-streams/general.js:

(test):
(promise_test):

web-platform-tests/streams/readable-streams/pipe-through.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/pipe-through.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/pipe-through.html.
web-platform-tests/streams/readable-streams/readable-stream-reader.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/readable-stream-reader.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/readable-stream-reader.html.
web-platform-tests/streams/readable-streams/readable-stream-reader.js:

(test):

web-platform-tests/streams/readable-streams/tee.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/tee.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/tee.html.
web-platform-tests/streams/readable-streams/templated.https-expected.txt: Added.
web-platform-tests/streams/readable-streams/templated.https.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/templated.html.
web-platform-tests/streams/readable-streams/w3c-import.log: Added.
web-platform-tests/streams/resources/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log.
web-platform-tests/streams/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/w3c-import.log.

LayoutTests:

platform/mac/TestExpectations: Renaming test filenames, and adding test expectation to area-coords.html.

Feb 25, 2016:

10:45 PM Changeset in webkit [197161] by ryuan.choi@navercorp.com

16 edits
2 moves
8 deletes in trunk/Source/WebKit2

[EFL] Remove WebUIPopupMenuClient
https://bugs.webkit.org/show_bug.cgi?id=154717

Reviewed by Gyuyoung Kim.

WebUIPopupMenuClient is only for EFL to expose WebPopupMenuProxy and WebPopupItem to WK C APIs.
This patch removes it and related code.

PlatformEfl.cmake: Removed WKPopupItem related files from source list.
UIProcess/API/C/efl/WKAPICastEfl.h: Removed WKPopupMenu related code.
UIProcess/API/C/efl/WKPageEfl.cpp: Removed.
UIProcess/API/C/efl/WKPageEfl.h: Removed.
UIProcess/API/C/efl/WKPopupItem.cpp: Removed.
UIProcess/API/C/efl/WKPopupItem.h: Removed.
UIProcess/API/C/efl/WKPopupMenuListener.cpp: Removed.
UIProcess/API/C/efl/WKPopupMenuListener.h: Removed.
UIProcess/API/efl/EwkView.cpp:

(EwkView::requestPopupMenu):

UIProcess/API/efl/EwkView.h:
UIProcess/API/efl/ewk_popup_menu.cpp:

(EwkPopupMenu::EwkPopupMenu):
(EwkPopupMenu::close):
(EwkPopupMenu::setSelectedIndex):

UIProcess/API/efl/ewk_popup_menu_item.cpp: Used WebPopupItem and others instead of WK C APIs.
UIProcess/API/efl/ewk_popup_menu_item_private.h: Ditto.
UIProcess/API/efl/ewk_popup_menu_private.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::close): Removed unnecessary EFL guards.
(WebKit::WebPageProxy::showPopupMenu): Ditto.
(WebKit::WebPageProxy::hidePopupMenu): Ditto.

UIProcess/WebPageProxy.h:
UIProcess/WebPopupMenuProxy.h:
UIProcess/efl/PageUIClientEfl.cpp: Removed WKPopupMenuListener related code.

(WebKit::PageUIClientEfl::PageUIClientEfl): Deleted.
(WebKit::PageUIClientEfl::showPopupMenu): Deleted.
(WebKit::PageUIClientEfl::hidePopupMenu): Deleted.

UIProcess/efl/PageUIClientEfl.h:
UIProcess/efl/WebPageProxyEfl.cpp:

(WebKit::WebPageProxy::initializeUIPopupMenuClient): Deleted.

UIProcess/efl/WebPopupMenuListenerEfl.cpp:

(WebKit::WebPopupMenuListenerEfl::WebPopupMenuListenerEfl): Deleted.
(WebKit::WebPopupMenuListenerEfl::valueChanged): Deleted.

UIProcess/efl/WebPopupMenuListenerEfl.h:

(WebKit::WebPopupMenuListenerEfl::create): Deleted.

UIProcess/efl/WebPopupMenuProxyEfl.cpp: Used WebPopupItem and others instead of WK C APIs.
UIProcess/efl/WebPopupMenuProxyEfl.h: Ditto.

(WebKit::WebPopupMenuProxyEfl::create):

UIProcess/efl/WebUIPopupMenuClient.cpp: Removed.
UIProcess/efl/WebUIPopupMenuClient.h: Removed.
UIProcess/efl/WebView.cpp:

(WebKit::WebView::createPopupMenuProxy): Used WebPopupItem and others instead of WK C APIs.

10:38 PM Changeset in webkit [197160] by mmaxfield@apple.com

12 edits in trunk

Font size computed style is innaccurate
https://bugs.webkit.org/show_bug.cgi?id=154705
<rdar://problem/23474068>

Reviewed by Timothy Hatcher.

Source/WebCore:

Safari rounds the font size value reported to getComputedStyle(). Neither Firefox
nor Chrome do this.

Covered by existing tests.

css/CSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
(WebCore::fontSizeFromStyle):

LayoutTests:

Update expected results.

css3/calc/font-size-fractional-expected.txt:
css3/viewport-percentage-lengths/viewport-percentage-lengths-relative-font-size.html:
css3/viewport-percentage-lengths/viewport-percentage-lengths-relative-font-size-expected.txt:
editing/mac/attributed-string/font-size-expected.txt:
editing/mac/attributed-string/vertical-align-expected.txt:
platform/mac-mavericks/editing/mac/attributed-string/font-size-expected.txt:
platform/mac-mavericks/editing/mac/attributed-string/vertical-align-expected.txt:
platform/mac-yosemite/editing/mac/attributed-string/font-size-expected.txt:
platform/mac-yosemite/editing/mac/attributed-string/vertical-align-expected.txt:

9:59 PM Changeset in webkit [197159] by commit-queue@webkit.org

8 edits in trunk/Source/JavaScriptCore

[JSC] Be aggressive with OSR Entry to FTL if the DFG function was only used for OSR Entry itself
https://bugs.webkit.org/show_bug.cgi?id=154575

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-25
Reviewed by Filip Pizlo.

I noticed that imaging-gaussian-blur spends most of its
samples in DFG code despite executing most of the loop
iterations in FTL.

What this patch does is set a flag when a DFG function is entered.
If we try to triggerOSREntryNow() and the flag was never set,
we start compiling both the full function and the one for OSR Entry.

dfg/DFGJITCode.h:
dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileEntryExecutionFlag):
(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

dfg/DFGJITCompiler.h:
dfg/DFGOperations.cpp:
dfg/DFGPlan.cpp:

(JSC::DFG::Plan::Plan): Deleted.

dfg/DFGPlan.h:
dfg/DFGTierUpCheckInjectionPhase.cpp:

(JSC::DFG::TierUpCheckInjectionPhase::run):

9:20 PM Changeset in webkit [197158] by mmaxfield@apple.com

4 edits in trunk

REGRESSION(r195795): [WK2] fast/text/crash-complex-text-surrogate.html is flakey
https://bugs.webkit.org/show_bug.cgi?id=154709
<rdar://problem/24483596>

Reviewed by Dan Bernstein.

Tools:

Force auto-activation rules to a consistent state.

WebKitTestRunner/InjectedBundle/mac/InjectedBundleMac.mm:

(WTR::InjectedBundle::platformInitialize):

LayoutTests:

platform/mac-wk2/TestExpectations:

9:01 PM Changeset in webkit [197157] by akling@apple.com

2 edits in trunk/Source/WebKit2

[iOS] Enable PageCache backing store clearing optimization for WebKit2.
<https://webkit.org/b/154712>

Reviewed by Anders Carlsson.

We had an optimization for iOS where we'd tear down the compositing tree for
pages in the page cache, to save memory, but we were only enabling it when
instantiating a WebKit1 web view.

This patch enables the optimization for WebKit2 as well.

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::WebProcess):

8:39 PM WebKitIDL edited by Chris Dumez

Drop [TreatUndefinedAs=X] (diff)

8:36 PM Changeset in webkit [197156] by Chris Dumez

29 edits
9 adds in trunk

[Web IDL] Mark DOMString parameters as nullable when they should be
https://bugs.webkit.org/show_bug.cgi?id=154666

Reviewed by Darin Adler.

Source/WebCore:

Mark DOMString parameters as nullable when they should be. We previously
emulated nullable DOMString attributes by using:
[TreatNullAs=NullString, TreatUndefinedAs=NullString]
However, this was non-standard and very verbose. Also, developers would
sometimes forget the [TreatUndefinedAs=NullString] part and the behavior
would end up being wrong for undefined.

After this clean up, the non-standard [TreatUndefinedAs=NullString] is
no longer used so this patch drops support for it. Only
[TreatNullAs=NullString] remains and this one will be renamed to
[TreatNullAs=EmptyString] via Bug 154654 to match Web IDL standard.

Tests: fast/dom/Element/getElementsByTagNameNS-nullable.html

fast/dom/Node/nullable-parameters.html
fast/events/storageevent-initStorageEvent-nullable.html

Modules/mediastream/RTCPeerConnection.idl:

Drop [TreatUndefinedAs=NullString] from createDataChannel()'s first
parameter instead of marking it as nullable. This matches the
specification:

http://w3c.github.io/webrtc-pc/#rtcpeerconnection-interface-extensions-1

This means there is a slight behavior change when undefined is passed, it
now becomes the string "undefined" instead of a null String.

bindings/scripts/CodeGeneratorJS.pm:

(JSValueToNative):
Drop handling of [TreatUndefinedAs=] as it is no longer used.

bindings/scripts/IDLAttributes.txt:

Drop support for [TreatUndefinedAs=] as it is no longer used.

bindings/scripts/test/TestObj.idl:

dom/DOMImplementation.idl:

Make a few parameters nullable and drop [TreatNullAs=NullString,
TreatUndefinedAs=NullString]. There is no web-exposed behavior
change.

dom/Document.idl:
Make a few parameters nullable and drop [TreatNullAs=NullString, TreatUndefinedAs=NullString]. There is no web-exposed behavior change from this.
Drop these attributes from ObjC-specific bindings as they only matter to JS bindings.
The namespaceURI parameter to getElementsByTagNameNS() is now marked as nullable even though it only treated null as a null String, not undefined. This was a bug and did not match the specification: https://dom.spec.whatwg.org/#document

dom/Element.idl:
Make a few parameters nullable and drop [TreatNullAs=NullString, TreatUndefinedAs=NullString]. There is no web-exposed behavior change from this.
Drop these attributes from ObjC-specific bindings as they only matter to JS bindings.
The namespaceURI parameter to getElementsByTagNameNS() is now marked as nullable even though it only treated null as a null String, not undefined. This was a bug and did not match the specification: https://dom.spec.whatwg.org/#interface-element

dom/NamedNodeMap.idl:

Make a few parameters nullable and drop [TreatNullAs=NullString,
TreatUndefinedAs=NullString]. There is no web-exposed behavior
change from this.

dom/Node.idl:
Drop these attributes from isSupported() as this is not exposed to JS (only native bindings) and these attributes only matter to JS bindings.
Make the first parameter to lookupPrefix() / isDefaultNamespace() and lookupNamespaceURI() nullable. Previously, we treated null as a null string but not undefined. There is therefore a slight behavior change but this matches the specification: https://dom.spec.whatwg.org/#node

fileapi/Blob.idl:
html/HTMLButtonElement.idl:
html/HTMLCanvasElement.idl:
html/HTMLFieldSetElement.idl:
html/HTMLInputElement.idl:
html/HTMLKeygenElement.idl:
html/HTMLMediaElement.idl:
html/HTMLObjectElement.idl:
html/HTMLOutputElement.idl:
html/HTMLSelectElement.idl:
html/HTMLTextAreaElement.idl:
page/DOMWindow.idl:

Make a few parameters nullable and drop [TreatNullAs=NullString,
TreatUndefinedAs=NullString]. There is no web-exposed behavior
change from this.

storage/StorageEvent.idl:

Mark oldValueArg / newValueArg parameters to initStorageEvent()
as nullable. Previously, we only treated null as a null string,
not undefined. This is therefore a slight behavior change but
it matches the specification:
https://www.w3.org/TR/webstorage/#storageeventinit

LayoutTests:

Add test coverage for minor behavioral changes in this patch.

fast/dom/Element/getElementsByTagNameNS-nullable-expected.txt: Added.
fast/dom/Element/getElementsByTagNameNS-nullable.html: Added.
fast/dom/Node/nullable-parameters-expected.txt: Added.
fast/dom/Node/nullable-parameters.html: Added.
fast/dom/Node/resources/testdoc.xml: Added.
fast/dom/Node/resources/testdoc2.xml: Added.
fast/events/storageevent-initStorageEvent-nullable-expected.txt: Added.
fast/events/storageevent-initStorageEvent-nullable.html: Added.

7:15 PM WebKitGTK/StableRelease edited by clopez@igalia.com

(diff)

7:09 PM WebKitGTK/StableRelease edited by clopez@igalia.com

(diff)

6:04 PM Changeset in webkit [197155] by benjamin@webkit.org

2 edits in trunk/Source/JavaScriptCore

[JSC] Temporal Dead Zone checks on "this" are eliminated when doing OSR Entry to FTL
https://bugs.webkit.org/show_bug.cgi?id=154664

Reviewed by Saam Barati.

When doing OSR Enter into a constructor, we lose the information
that this may have been set to empty by a previously executed block.

All the code just assumed the type for a FlushedJS value and thus
not an empty value. It was then okay to eliminate the TDZ checks.

In this patch, the values on root entry now assume they may be empty.
As a result, the SetArgument() for "this" has "empty" as possible
type and the TDZ checks are no longer eliminated.

dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::initialize):

6:04 PM Changeset in webkit [197154] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore

REGRESSION (r196744): NetworkExtension.framework and NEFilterSource class are not available on Recovery partition
<http://webkit.org/b/154703>

Reviewed by Andy Estes.

platform/cocoa/NetworkExtensionContentFilter.mm: Make

soft-linking of NetworkExtension.framework and NEFilterSource
class optional since they are not available on the Recovery
partition. Note that NetworkExtensionContentFilter::enabled()
does not need to change since it already had the correct
behavior when getNEFilterSourceClass() returned nullptr.

6:03 PM Changeset in webkit [197153] by adachan@apple.com

8 edits in trunk/Source

Update the definition of ENABLE_VIDEO_PRESENTATION_MODE for Mac platform
https://bugs.webkit.org/show_bug.cgi?id=154702

Reviewed by Dan Bernstein.

Configurations/FeatureDefines.xcconfig:# Please enter the commit message for your changes. Lines starting

5:56 PM Changeset in webkit [197152] by Ryan Haddad

2 edits in trunk/LayoutTests

Skipping flaky test storage/indexeddb/intversion-open-in-upgradeneeded.html on mac-wk2
https://bugs.webkit.org/show_bug.cgi?id=154706

Unreviewed test gardening.

platform/mac-wk2/TestExpectations:

5:33 PM Changeset in webkit [197151] by jiewen_tan@apple.com

2 edits in trunk/Tools

Unreivewed build fix for r197150.

TestWebKitAPI/Tests/mac/IsNavigationActionTrusted.mm:

5:22 PM Changeset in webkit [197150] by jiewen_tan@apple.com

6 edits
2 adds in trunk

Restrict information passed with navigation action which is triggered by untrusted event
https://bugs.webkit.org/show_bug.cgi?id=154571
<rdar://problem/15967937>

Reviewed by Andy Estes.

Source/WebKit/mac:

WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::actionDictionary):

Source/WebKit2:

When navigation action is triggered by an untrusted event, we should be more restricted of
what information should be passed to the clients to lower the risk that clients could
be fooled by the untrusted event.

In this patch, we drop the modifiers for key state events and set the mouse button to NoButton
for mouse events.

WebProcess/InjectedBundle/InjectedBundleNavigationAction.cpp:

(WebKit::InjectedBundleNavigationAction::modifiersForNavigationAction):

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/mac/IsNavigationActionTrusted.mm: Added.

(-[WKNavigationActionDelegate webView:decidePolicyForNavigationAction:decisionHandler:]):
(TestWebKitAPI::TEST):
(-[NavigationActionDelegate webView:decidePolicyForNavigationAction:request:frame:decisionListener:]):

TestWebKitAPI/Tests/mac/IsNavigationActionTrusted.html: Added.

5:00 PM Changeset in webkit [197149] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore

Change ASSERT to RELEASE_ASSERT in SOFT_LINK_CLASS() macro

Follow-up fix noted by Andy Estes for:

[Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
<http://webkit.org/b/154364>

platform/mac/SoftLinking.h:

(SOFT_LINK_CLASS): Change ASSERT to RELEASE_ASSERT to check the
return value of objc_getClass(). This matches what we do for
SOFT_LINK_CLASS_FOR_SOURCE().

4:58 PM Changeset in webkit [197148] by dbates@webkit.org

2 edits in trunk/LayoutTests

[iOS Simulator] http/tests/security/contentSecurityPolicy/1.1/plugintypes tests failing
https://bugs.webkit.org/show_bug.cgi?id=154652

Skip Content Security Policy plugin-types tests when run in the iOS simulator app because
plugins are not supported on iOS.

platform/ios-simulator/TestExpectations:

4:54 PM Changeset in webkit [197147] by barraclough@apple.com

2 edits in trunk/Source/WTF

Replace RefCounter::Token implementation with RefPtr
https://bugs.webkit.org/show_bug.cgi?id=154698

Reviewed by Anders Carlsson.

wtf/RefCounter.h:

(WTF::RefCounter::RefCounter):
(WTF::RefCounter::count):
(WTF::RefCounter::value):
(WTF::RefCounter<T>::~RefCounter):
(WTF::RefCounter::Token::Token): Deleted.
(WTF::RefCounter::Token::operator bool): Deleted.
(WTF::RefCounter<T>::Token::Token): Deleted.
(WTF::=): Deleted.

Delete.

4:45 PM Changeset in webkit [197146] by barraclough@apple.com

2 edits in trunk/Source/WTF

Should template RefCounter instead of RefCounter::Token
https://bugs.webkit.org/show_bug.cgi?id=154691

Speculative windows build fix.

wtf/RefCounter.h:

(WTF::RefCounter::RefCounter):
(WTF::RefCounter::count):

4:33 PM Changeset in webkit [197145] by mmaxfield@apple.com

71 edits
1 add in trunk

[Win] [SVG -> OTF Converter] Support the SVG -> OTF Font Converter
https://bugs.webkit.org/show_bug.cgi?id=143402

Reviewed by Alex Christensen.

Turn on by default, and turn on for Windows.

EFL and GTK already explicitly disable it in OptionsEfl.cmake and OptionsGTK.cmake.

Source/cmake/OptionsWin.cmake:
Source/cmake/WebKitFeatures.cmake:

LayoutTests:

Rebaseline many tests.

There are some known bugs (which are marked in platform/win/TestExpecations):
webkit.org/b/137204 The SVG -> OTF Font converter outputs 'kern' tables instead of 'GPOS' tables
webkit.org/b/154690 SVG Fonts don't draw multibyte characters
webkit.org/b/137096 The SVG -> OTF Font Converter does not work with SVG's "altglyph" facility
webkit.org/b/137093 Same thing with the "lang" attribute

platform/win/svg/W3C-SVG-1.1/fonts-desc-02-t-expected.txt: Added.
platform/win/svg/W3C-SVG-1.1/text-text-06-t-expected.txt: Added.
platform/win/TestExpectations:
platform/win/svg/W3C-SVG-1.1-SE/color-prop-05-t-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/coords-dom-01-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/coords-dom-02-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/coords-dom-03-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/coords-dom-04-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/coords-units-03-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/filters-felem-01-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/filters-image-03-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/interact-pointer-03-t-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/painting-marker-07-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/pservers-grad-17-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/pservers-grad-20-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/pservers-pattern-03-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/pservers-pattern-04-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/struct-use-14-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/styling-css-04-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/styling-pres-02-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/svgdom-over-01-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/text-tref-03-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/text-tspan-02-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/types-dom-02-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/types-dom-03-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/types-dom-04-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/types-dom-05-b-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/types-dom-06-f-expected.txt:
platform/win/svg/W3C-SVG-1.1-SE/types-dom-07-f-expected.txt:
platform/win/svg/W3C-SVG-1.1/animate-elem-03-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/animate-elem-24-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/animate-elem-36-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/animate-elem-40-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/filters-light-04-f-expected.txt:
platform/win/svg/W3C-SVG-1.1/filters-turb-02-f-expected.txt:
platform/win/svg/W3C-SVG-1.1/fonts-elem-01-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/fonts-elem-02-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/fonts-elem-03-b-expected.txt:
platform/win/svg/W3C-SVG-1.1/fonts-elem-04-b-expected.txt:
platform/win/svg/W3C-SVG-1.1/fonts-elem-05-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/fonts-elem-06-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/fonts-elem-07-b-expected.txt:
platform/win/svg/W3C-SVG-1.1/masking-mask-01-b-expected.txt:
platform/win/svg/W3C-SVG-1.1/pservers-grad-08-b-expected.txt:
platform/win/svg/W3C-SVG-1.1/render-elems-06-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/render-elems-07-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/render-elems-08-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/render-groups-01-b-expected.txt:
platform/win/svg/W3C-SVG-1.1/render-groups-03-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/text-fonts-03-t-expected.txt:
platform/win/svg/W3C-SVG-1.1/text-intro-02-b-expected.txt:
platform/win/svg/W3C-SVG-1.1/text-intro-03-b-expected.txt:
platform/win/svg/batik/text/textEffect-expected.txt:
platform/win/svg/batik/text/textEffect3-expected.txt:
platform/win/svg/custom/glyph-selection-arabic-forms-expected.txt:
platform/win/svg/custom/svg-fonts-in-html-expected.txt:
platform/win/svg/custom/svg-fonts-with-no-element-reference-expected.txt: Added.
platform/win/svg/custom/svg-fonts-word-spacing-expected.txt:
platform/win/svg/foreignObject/text-tref-02-b-expected.txt:
platform/win/svg/hixie/intrinsic/003-expected.txt:
platform/win/svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures-expected.txt:
platform/win/svg/text/text-text-04-t-expected.txt:
platform/win/svg/text/text-text-05-t-expected.txt:
platform/win/svg/text/text-text-06-t-expected.txt:
platform/win/svg/wicd/test-rightsizing-b-expected.txt:
platform/win/svg/zoom/page/zoom-svg-through-object-with-absolute-size-2-expected.txt:
platform/win/svg/zoom/page/zoom-svg-through-object-with-absolute-size-expected.txt:

4:15 PM Changeset in webkit [197144] by sbarati@apple.com

7 edits in trunk/Source/JavaScriptCore

[ES6] for...in iteration doesn't comply with the specification
https://bugs.webkit.org/show_bug.cgi?id=154665

Reviewed by Michael Saboff.

If you read ForIn/OfHeadEvaluation inside the spec:
https://tc39.github.io/ecma262/#sec-runtime-semantics-forin-div-ofheadevaluation-tdznames-expr-iterationkind
It calls EnumerateObjectProperties(obj) to get a set of properties
to enumerate over (it models this "set" as en ES6 generator function).
EnumerateObjectProperties is defined in section 13.7.5.15:
https://tc39.github.io/ecma262/#sec-enumerate-object-properties
The implementation calls Reflect.getOwnPropertyDescriptor(.) on the
properties it sees. We must do the same by modeling the operation as
a GetOwnProperty instead of a HasProperty internal method call.

jit/JITOperations.cpp:
jit/JITOperations.h:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/JSObject.cpp:

(JSC::JSObject::hasProperty):
(JSC::JSObject::hasPropertyGeneric):

runtime/JSObject.h:
tests/stress/proxy-get-own-property.js:

(assert):
(let.handler.getOwnPropertyDescriptor):
(i.set assert):

3:59 PM Changeset in webkit [197143] by commit-queue@webkit.org

2 edits in trunk/Source/WTF

Unreviewed, rolling out r197137.
https://bugs.webkit.org/show_bug.cgi?id=154700

broke windows build (Requested by alexchristensen on #webkit).

Reverted changeset:

"Replace RefCounter::Token implementation with RefPtr"
https://bugs.webkit.org/show_bug.cgi?id=154698
http://trac.webkit.org/changeset/197137

3:52 PM Changeset in webkit [197142] by dbates@webkit.org

14 edits
34 deletes in trunk

CSP: Remove SecurityPolicy script interface
https://bugs.webkit.org/show_bug.cgi?id=154694
<rdar://problem/24846482>

Reviewed by Andy Estes.

Source/WebCore:

Remove the Content Security Policy script interface, SecurityPolicy. This interface was only
enabled when building with ENABLE(CSP_NEXT) (disabled by default).

CMakeLists.txt: Remove files to DOMSecurityPolicy.{cpp, idl}.
DerivedSources.cpp: Remove file JSDOMSecurityPolicy.cpp.
DerivedSources.make: Remove file DOMSecurityPolicy.idl.
PlatformGTK.cmake: Ditto.
PlatformMac.cmake: Ditto.
WebCore.xcodeproj/project.pbxproj: Remove files DOMSecurityPolicy files.
bindings/scripts/CodeGeneratorGObject.pm: Remove reference to DOMSecurityPolicy.
dom/Document.cpp:

(WebCore::Document::securityPolicy): Deleted.

dom/Document.h:
dom/Document.idl: Remove attribute securityPolicy.
page/DOMSecurityPolicy.cpp: Removed.
page/DOMSecurityPolicy.h: Removed.
page/DOMSecurityPolicy.idl: Removed.

LayoutTests:

Remove SecurityPolicy tests and update platform-specific expected results as needed.

http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive.html: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi.html: Removed.
http/tests/security/contentSecurityPolicy/resources/securitypolicy-tests-base.js: Removed.
platform/gtk/js/dom/global-constructors-attributes-expected.txt: Update expected result as needed.
platform/win/js/dom/global-constructors-attributes-expected.txt: Ditto.

3:24 PM Changeset in webkit [197141] by akling@apple.com

2 edits in trunk/Source/WebCore

Don't clear the weak JSString cache on memory pressure.
<https://webkit.org/b/154693>

Reviewed by Antti Koivisto.

This was stupid. The cache is a WeakGCMap, so all the JSStrings pointed to are
still alive anyway. This way we keep the ability to deduplicate common strings.

platform/MemoryPressureHandler.cpp:

(WebCore::MemoryPressureHandler::releaseNoncriticalMemory): Deleted.

3:24 PM Changeset in webkit [197140] by bshafiei@apple.com

5 edits in tags/Safari-602.1.19.2/Source

Versioning.

3:24 PM Changeset in webkit [197139] by Chris Dumez

9 edits
2 adds in trunk

Drop [TreatReturnedNullStringAs=Undefined] WebKit-specific IDL attribute
https://bugs.webkit.org/show_bug.cgi?id=154662

Reviewed by Darin Adler.

Source/WebCore:

Drop [TreatReturnedNullStringAs=Undefined] WebKit-specific IDL attribute.
This has no standard equivalent and all uses in WebKit are either useless
or wrong.

Test: fast/frames/detached-frame-document-defaultCharset.html

bindings/scripts/CodeGeneratorJS.pm:

(NativeToJSValue): Deleted.

bindings/scripts/IDLAttributes.txt:

Drop support for [TreatReturnedNullStringAs=X] entirely.

dom/Document.cpp:

(WebCore::Document::defaultCharset):
Fall back to return "UTF-8" instead of the null string, similarly to
what is done in for Document.characterSet. Note that this attribute
is non-standard and is an IE extension. Firefox never supported it
and Chrome dropped it last year.

dom/Document.idl:
Drop extended attribute for Document.defaultCharset as the implementation has been updated to never return a null String.
Drop extended attribute for Document.readyState. It was useless because the implementation could never return a null String.

xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::getAllResponseHeaders):
Update implementation to return emptyString() instead of "" in case
of error.

xml/XMLHttpRequest.idl:

Drop extended attribute from XMLHttpRequest.getAllResponseHeaders().
It was useless because the implementation could never return a
null String.

xml/XSLTProcessor.idl:

Drop extended attribute from XSLTProcessor.getParameter(). The
operation is already marked as [Custom] so the extended attribute
had no effect.

LayoutTests:

Add layout test to cover the return value of document.defaultCharset before
and after its frame is detached.

fast/frames/detached-frame-document-defaultCharset-expected.txt: Added.
fast/frames/detached-frame-document-defaultCharset.html: Added.

3:14 PM WebKitIDL edited by Chris Dumez

[TreatReturnedNullStringAs=X] was dropped (diff)

3:12 PM Changeset in webkit [197138] by beidson@apple.com

4 edits
1 delete in trunk/LayoutTests

Unreviewed test gardening.

Fix a test flake where order doesn't matter.

platform/wk2/storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt: Removed.
storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt:
storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-private-expected.txt:
storage/indexeddb/resources/deletedatabase-delayed-by-open-and-versionchange.js:

(prepareDatabase.request.onblocked):
(onOpenSuccess):

3:10 PM Changeset in webkit [197137] by barraclough@apple.com

2 edits in trunk/Source/WTF

Replace RefCounter::Token implementation with RefPtr
https://bugs.webkit.org/show_bug.cgi?id=154698

Reviewed by Anders Carlsson.

wtf/RefCounter.h:

Delete.

2:58 PM Changeset in webkit [197136] by sbarati@apple.com

8 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Implement Proxy.Set
https://bugs.webkit.org/show_bug.cgi?id=154511

Reviewed by Filip Pizlo.

This patch is mostly an implementation of
Proxy.Set with respect to section 9.5.9
of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver

This patch also changes JSObject::putInline and JSObject::putByIndex
to be aware that a Proxy in the prototype chain will intercept
property accesses.

runtime/JSObject.cpp:

(JSC::JSObject::putInlineSlow):
(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):

runtime/JSObject.h:
runtime/JSObjectInlines.h:

(JSC::JSObject::canPerformFastPutInline):
(JSC::JSObject::putInline):

runtime/JSType.h:
runtime/ProxyObject.cpp:

(JSC::ProxyObject::getOwnPropertySlotByIndex):
(JSC::ProxyObject::performPut):
(JSC::ProxyObject::put):
(JSC::ProxyObject::putByIndexCommon):
(JSC::ProxyObject::putByIndex):
(JSC::performProxyCall):
(JSC::ProxyObject::getCallData):
(JSC::performProxyConstruct):
(JSC::ProxyObject::deletePropertyByIndex):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h:

(JSC::ProxyObject::create):
(JSC::ProxyObject::createStructure):
(JSC::ProxyObject::target):
(JSC::ProxyObject::handler):

tests/es6.yaml:
tests/stress/proxy-set.js: Added.

(assert):
(throw.new.Error.let.handler.set 45):
(throw.new.Error):
(let.target.set x):
(let.target.get x):
(set let):

2:44 PM Changeset in webkit [197135] by Ryan Haddad

3 edits in trunk/LayoutTests

Removing failure expectation for 26 editing tests that now pass on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=152131

Unreviewed test gardening.

platform/ios-simulator-wk2/TestExpectations:
platform/ios-simulator/TestExpectations:

2:37 PM Changeset in webkit [197134] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

[JSC] Remove a useless "Move" in the lowering of Select
https://bugs.webkit.org/show_bug.cgi?id=154670

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-25
Reviewed by Geoffrey Garen.

I left the Move instruction when creating the aliasing form
of Select.

On ARM64, that meant a useless move for any case that can't
be coalesced.

On x86, that meant an extra constraint on child2, making it
stupidly hard to alias child1.

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::createSelect): Deleted.

2:37 PM Changeset in webkit [197133] by adachan@apple.com

3 edits in trunk/Source/WebKit2

Hook up fullscreenMayReturnToInline() in WKPageUIClient
https://bugs.webkit.org/show_bug.cgi?id=154661

Reviewed by Tim Horton.

UIProcess/API/C/WKPage.cpp:

(WKPageSetPageUIClient):

UIProcess/API/C/WKPageUIClient.h:

2:24 PM Changeset in webkit [197132] by barraclough@apple.com

16 edits
1 delete in trunk

Should template RefCounter instead of RefCounter::Token
https://bugs.webkit.org/show_bug.cgi?id=154691

Reviewed by Anders Carlsson.

Source/WebCore:

Mechanical update per RefCounter interface change.

page/PageThrottler.cpp:

(WebCore::PageThrottler::mediaActivityToken):
(WebCore::PageThrottler::pageLoadActivityToken):
(WebCore::PageThrottler::setActivityFlag):

page/PageThrottler.h:
platform/VNodeTracker.h:

Source/WebKit2:

Mechanical update per RefCounter interface change.

UIProcess/Plugins/PluginProcessManager.h:

(WebKit::PluginProcessManager::processSuppressionDisabledToken):
(WebKit::PluginProcessManager::processSuppressionDisabled):

UIProcess/ProcessThrottler.h:

(WebKit::ProcessThrottler::foregroundActivityToken):
(WebKit::ProcessThrottler::backgroundActivityToken):

UIProcess/WebProcessPool.h:

Source/WTF:

My real goal here is to make the counter accurate. Currently returning a Token from token<>()
results in ref-count churn. Fixing this either means changing the return value, or improving
Token (which will probably mean replacing it with RefPtr). Either way would break the current
type checking. Move type tag to RefCount so this can still be enforced.

WTF.vcxproj/WTF.vcxproj:
WTF.vcxproj/WTF.vcxproj.filters:
WTF.xcodeproj/project.pbxproj:
wtf/CMakeLists.txt:
wtf/RefCounter.cpp: Removed.
- Removed RefCounter.cpp.
wtf/RefCounter.h:

(WTF::RefCounter::Token::Token):
(WTF::RefCounter::Token::operator bool):
(WTF::RefCounter::RefCounter):
(WTF::RefCounter::count):
(WTF::RefCounter::value):
(WTF::RefCounter<T>::Count::ref):
(WTF::RefCounter<T>::Count::deref):
(WTF::RefCounter<T>::RefCounter):
(WTF::RefCounter<T>::~RefCounter):
(WTF::RefCounter<T>::Token::Token):
(WTF::=):
(WTF::RefCounter::token): Deleted.
(WTF::RefCounter::Token<T>::Token): Deleted.

RefCounter -> RefCounter<T>,
Token<T> -> Token,
renamed token<>() -> count().

Tools:

Mechanical update per RefCounter interface change.

TestWebKitAPI/Tests/WTF/RefCounter.cpp:

(TestWebKitAPI::TEST):

2:19 PM Changeset in webkit [197131] by beidson@apple.com

41 edits
24 deletes in trunk/Source

Remove LegacyIDB.
https://bugs.webkit.org/show_bug.cgi?id=150854

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (No change in behavior).

CMakeLists.txt:
Modules/indexeddb/DOMWindowIndexedDatabase.cpp:

(WebCore::DOMWindowIndexedDatabase::indexedDB):

Modules/indexeddb/IDBDatabaseMetadata.cpp: Removed.
Modules/indexeddb/IDBDatabaseMetadata.h: Removed.
Modules/indexeddb/IDBFactory.h:
Modules/indexeddb/IDBIndex.h:
Modules/indexeddb/IDBIndexMetadata.h: Removed.
Modules/indexeddb/IDBObjectStoreMetadata.h: Removed.
Modules/indexeddb/IDBOperation.h: Removed.
Modules/indexeddb/IDBServerConnection.h: Removed.
Modules/indexeddb/IDBTransaction.h:
Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:

(WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):

Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:
Modules/indexeddb/legacy/IDBCallbacks.h: Removed.
Modules/indexeddb/legacy/IDBCursorBackend.cpp: Removed.
Modules/indexeddb/legacy/IDBCursorBackend.h: Removed.
Modules/indexeddb/legacy/IDBCursorBackendOperations.cpp: Removed.
Modules/indexeddb/legacy/IDBCursorBackendOperations.h: Removed.
Modules/indexeddb/legacy/IDBDatabaseBackend.cpp: Removed.
Modules/indexeddb/legacy/IDBDatabaseBackend.h: Removed.
Modules/indexeddb/legacy/IDBDatabaseCallbacks.h: Removed.
Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.cpp: Removed.
Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.h: Removed.
Modules/indexeddb/legacy/IDBFactoryBackendInterface.h: Removed.
Modules/indexeddb/legacy/IDBPendingDeleteCall.h: Removed.
Modules/indexeddb/legacy/IDBPendingOpenCall.h: Removed.
Modules/indexeddb/legacy/IDBPendingTransactionMonitor.cpp: Removed.
Modules/indexeddb/legacy/IDBPendingTransactionMonitor.h: Removed.
Modules/indexeddb/legacy/IDBTransactionBackend.cpp: Removed.
Modules/indexeddb/legacy/IDBTransactionBackend.h: Removed.
Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp: Removed.
Modules/indexeddb/legacy/IDBTransactionBackendOperations.h: Removed.
Modules/indexeddb/legacy/IDBTransactionCoordinator.cpp: Removed.
Modules/indexeddb/legacy/IDBTransactionCoordinator.h: Removed.
Modules/indexeddb/legacy/LegacyAny.cpp: Removed.
Modules/indexeddb/legacy/LegacyAny.h: Removed.
Modules/indexeddb/legacy/LegacyCursor.cpp: Removed.
Modules/indexeddb/legacy/LegacyCursor.h: Removed.
Modules/indexeddb/legacy/LegacyCursorWithValue.cpp: Removed.
Modules/indexeddb/legacy/LegacyCursorWithValue.h: Removed.
Modules/indexeddb/legacy/LegacyDatabase.cpp: Removed.
Modules/indexeddb/legacy/LegacyDatabase.h: Removed.
Modules/indexeddb/legacy/LegacyFactory.cpp: Removed.
Modules/indexeddb/legacy/LegacyFactory.h: Removed.
Modules/indexeddb/legacy/LegacyIndex.cpp: Removed.
Modules/indexeddb/legacy/LegacyIndex.h: Removed.
Modules/indexeddb/legacy/LegacyObjectStore.cpp: Removed.
Modules/indexeddb/legacy/LegacyObjectStore.h: Removed.
Modules/indexeddb/legacy/LegacyOpenDBRequest.cpp: Removed.
Modules/indexeddb/legacy/LegacyOpenDBRequest.h: Removed.
Modules/indexeddb/legacy/LegacyRequest.cpp: Removed.
Modules/indexeddb/legacy/LegacyRequest.h: Removed.
Modules/indexeddb/legacy/LegacyTransaction.cpp: Removed.
Modules/indexeddb/legacy/LegacyTransaction.h: Removed.
Modules/indexeddb/legacy/LegacyVersionChangeEvent.cpp: Removed.
Modules/indexeddb/legacy/LegacyVersionChangeEvent.h: Removed.
Modules/indexeddb/server/SQLiteIDBCursor.cpp:

(WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
(WebCore::IDBServer::SQLiteIDBCursor::establishStatement):
(WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):

Modules/indexeddb/server/SQLiteIDBCursor.h:
Modules/indexeddb/shared/IDBIndexInfo.h:
WebCore.xcodeproj/project.pbxproj:
bindings/js/IDBBindingUtilities.cpp:

(WebCore::generateIndexKeysForValue): Deleted.

bindings/js/IDBBindingUtilities.h:
bindings/js/JSMainThreadExecState.cpp:

(WebCore::JSMainThreadExecState::didLeaveScriptContext): Deleted.

inspector/InspectorIndexedDBAgent.cpp:
loader/EmptyClients.cpp:
page/DatabaseProvider.cpp:

(WebCore::DatabaseProvider::idbFactoryBackend): Deleted.

page/DatabaseProvider.h:
platform/CrossThreadCopier.cpp:

(WebCore::IDBDatabaseMetadata>::copy): Deleted.
(WebCore::IDBIndexMetadata>::copy): Deleted.
(WebCore::IDBObjectStoreMetadata>::copy): Deleted.

platform/CrossThreadCopier.h:

Source/WebKit:

Storage/WebDatabaseProvider.cpp:

(WebDatabaseProvider::createIDBFactoryBackend): Deleted.

Storage/WebDatabaseProvider.h:

Source/WebKit2:

CMakeLists.txt:
DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::getOrCreateLegacyUniqueIDBDatabase): Deleted.
(WebKit::DatabaseProcess::removeLegacyUniqueIDBDatabase): Deleted.

DatabaseProcess/DatabaseProcess.h:
DatabaseProcess/DatabaseToWebProcessConnection.cpp:

DatabaseProcess/DatabaseToWebProcessConnection.h:
DatabaseProcess/DatabaseToWebProcessConnection.messages.in:
DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.cpp: Removed.
DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.h: Removed.
DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.messages.in: Removed.
DatabaseProcess/IndexedDB/IDBIdentifier.h: Removed.
DatabaseProcess/IndexedDB/IDBSerialization.cpp: Removed.
DatabaseProcess/IndexedDB/IDBSerialization.h: Removed.
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.cpp: Removed.
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.h: Removed.
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.cpp: Removed.
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.h: Removed.
DatabaseProcess/IndexedDB/UniqueIDBDatabaseBackingStore.h: Removed.
DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h:
DatabaseProcess/IndexedDB/sqlite/SQLiteIDBCursor.cpp: Removed.
DatabaseProcess/IndexedDB/sqlite/SQLiteIDBCursor.h: Removed.
DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.cpp: Removed.
DatabaseProcess/IndexedDB/sqlite/SQLiteIDBTransaction.h: Removed.
DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp: Removed.
DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.h: Removed.
DerivedSources.make:
Shared/WebCrossThreadCopier.cpp:

(WebCore::LegacyUniqueIDBDatabaseIdentifier>::copy): Deleted.
(WebCore::IDBIdentifier>::copy): Deleted.

Shared/WebCrossThreadCopier.h:
WebKit2.xcodeproj/project.pbxproj:
WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.cpp: Removed.
WebProcess/Databases/IndexedDB/WebIDBFactoryBackend.h: Removed.
WebProcess/Databases/IndexedDB/WebIDBServerConnection.cpp: Removed.
WebProcess/Databases/IndexedDB/WebIDBServerConnection.h: Removed.
WebProcess/Databases/IndexedDB/WebIDBServerConnection.messages.in: Removed.
WebProcess/Databases/WebDatabaseProvider.cpp:

(WebKit::WebDatabaseProvider::createIDBFactoryBackend): Deleted.

WebProcess/Databases/WebDatabaseProvider.h:
WebProcess/Databases/WebToDatabaseProcessConnection.cpp:

WebProcess/Databases/WebToDatabaseProcessConnection.h:
WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:

1:38 PM Changeset in webkit [197130] by beidson@apple.com

2 edits in trunk/LayoutTests

Unreviewed test gardening.

TestExpectations: Skip a web inspector IndexedDB test for now.

12:52 PM Changeset in webkit [197129] by bshafiei@apple.com

1 copy in tags/Safari-602.1.19.2

New tag.

12:51 PM Changeset in webkit [197128] by bshafiei@apple.com

2 edits in tags/Safari-602.1.20/Source/WebKit

Merged r197124. rdar://problem/24747822

12:32 PM Changeset in webkit [197127] by Ryan Haddad

2 edits in trunk/LayoutTests

Removing a pass expectation for inspector/indexeddb/requestDatabaseNames.html that overrides the skip r197122

Unreviewed test gardening.

platform/mac/TestExpectations:

12:23 PM Changeset in webkit [197126] by gskachkov@gmail.com

2 edits in trunk/Tools

Unreviewed, move Aleksandr Skachkov to committers list

11:55 AM Changeset in webkit [197125] by Said Abou-Hallawa

4 edits in trunk/Source/WebCore

REGRESSION (r196268): Many assertion failures and crashes on SVG path animation tests when JS garbage collection happens quickly
https://bugs.webkit.org/show_bug.cgi?id=154331

Reviewed by Darin Adler.

svg/SVGPathElement.cpp:

svg/SVGPathElement.h:
svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:

11:36 AM Changeset in webkit [197124] by Brent Fulgham

2 edits in trunk/Source/WebKit

[Win][CMake] Don't use incremental linking
https://bugs.webkit.org/show_bug.cgi?id=154684
<rdar://problem/24747822>

Reviewed by Alex Christensen.

PlatformWin.cmake: Make sure the "/INCREMENTAL:NO" flag is used

(overriding "/INCREMENTAL:YES").

11:28 AM Changeset in webkit [197123] by weinig@apple.com

4 edits in trunk

Source/WTF:
HashMap::ensure() should return an AddResult like all the other add-like functions.
https://bugs.webkit.org/show_bug.cgi?id=154680

Reviewed by Anders Carlsson.

wtf/HashMap.h:

Change return type of HashMap::ensure() to be an AddResult.

Tools:
HashMap::ensure() should return an AddResult like all the other add-like functions
https://bugs.webkit.org/show_bug.cgi?id=154680

Reviewed by Anders Carlsson.

TestWebKitAPI/Tests/WTF/HashMap.cpp:

(TestWebKitAPI::TEST):
Update tests to use/test the new AddResult result.

11:21 AM Changeset in webkit [197122] by beidson@apple.com

11 edits
1 add
37 deletes in trunk

Modern IDB: WebKit 2 IPC layer.
https://bugs.webkit.org/show_bug.cgi?id=153808

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (Covered by over 1,000 existing tests).

Modules/indexeddb/IDBKeyData.h:

(WebCore::IDBKeyData::encode): It's okay to encode Min and Max.
(WebCore::IDBKeyData::decode): It's okay to decode Min and Max.

Source/WebKit2:

NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad): This ASSERT fires on most WK2 tests. Alex said remove it.

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::putOrAdd): Properly encode the overwrite flag.

WebProcess/Databases/WebDatabaseProvider.h: Enable Modern IDB.

LayoutTests:

Consolidate all test failures to the platform agnostic TestExpectations file.
Remove all existing WK2-specific results.
Add one new WK2-specific result.
Skip two WK2-only failures.

TestExpectations:
platform/mac-wk1/TestExpectations:
platform/mac-wk2/TestExpectations:
platform/wk2/TestExpectations:
platform/wk2/imported/w3c/indexeddb/abort-in-initial-upgradeneeded-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor-advance-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_advance_index5-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_advance_index9-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_advance_objectstore5-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index5-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index6-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_index8-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_invalid-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_continue_objectstore6-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_delete_index4-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbcursor_delete_objectstore4-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbdatabase_close2-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbdatabase_deleteObjectStore4-not_reused-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbfactory_deleteDatabase3-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbfactory_open12-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex-multientry-big-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_get3-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_get7-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_getKey7-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_openCursor2-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbindex_openKeyCursor3-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_add4-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex2-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex4-deleteIndex-event_order-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex6-event_order-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_createIndex7-event_order-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbobjectstore_put4-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbtransaction_abort-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/idbversionchangeevent-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/keygenerator-constrainterror-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/keygenerator-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/keygenerator-overflow-expected.txt: Removed.
platform/wk2/imported/w3c/indexeddb/transaction-requestqueue-expected.txt: Removed.
platform/wk2/storage/indexeddb/aborted-versionchange-closes-expected.txt: Removed.
platform/wk2/storage/indexeddb/bad-keypath-expected.txt: Removed.
platform/wk2/storage/indexeddb/basics-expected.txt: Removed.
platform/wk2/storage/indexeddb/clear-expected.txt: Removed.
platform/wk2/storage/indexeddb/create-and-remove-object-store-expected.txt: Removed.
platform/wk2/storage/indexeddb/create-objectstore-basics-expected.txt: Removed.
platform/wk2/storage/indexeddb/cursor-continue-dir-expected.txt: Removed.
platform/wk2/storage/indexeddb/cursor-continue-expected.txt: Removed.
platform/wk2/storage/indexeddb/cursor-finished-expected.txt: Removed.
platform/wk2/storage/indexeddb/cursors-expected.txt: Removed.
platform/wk2/storage/indexeddb/database-basics-expected.txt: Removed.
platform/wk2/storage/indexeddb/deleteIndex-bug110792-expected.txt: Removed.
platform/wk2/storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt: Added.
platform/wk2/storage/indexeddb/index-count-expected.txt: Removed.
platform/wk2/storage/indexeddb/intversion-abort-in-initial-upgradeneeded-expected.txt: Removed.
platform/wk2/storage/indexeddb/intversion-close-in-oncomplete-expected.txt: Removed.
platform/wk2/storage/indexeddb/intversion-close-in-upgradeneeded-expected.txt: Removed.
platform/wk2/storage/indexeddb/invalid-keys-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-requirements-delete-null-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-requirements-inline-and-passed-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-requirements-put-no-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-requirements-put-null-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/key-type-array-expected.txt: Removed.
platform/wk2/storage/indexeddb/keypath-arrays-expected.txt: Removed.
platform/wk2/storage/indexeddb/keypath-edges-expected.txt: Removed.
platform/wk2/storage/indexeddb/keyrange-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/bad-keypath-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/clear-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/create-objectstore-basics-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/cursors-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/key-requirements-delete-null-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/key-requirements-inline-and-passed-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/key-requirements-put-no-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/key-requirements-put-null-key-expected.txt: Removed.
platform/wk2/storage/indexeddb/mozilla/readonly-transactions-expected.txt: Removed.
platform/wk2/storage/indexeddb/object-lookups-in-versionchange-expected.txt: Removed.
platform/wk2/storage/indexeddb/objectstore-count-expected.txt: Removed.
platform/wk2/storage/indexeddb/open-cursor-expected.txt: Removed.
platform/wk2/storage/indexeddb/readonly-transactions-expected.txt: Removed.
platform/wk2/storage/indexeddb/request-result-cache-expected.txt: Removed.
platform/wk2/storage/indexeddb/transaction-abort-expected.txt: Removed.
platform/wk2/storage/indexeddb/transaction-active-flag-expected.txt: Removed.
platform/wk2/storage/indexeddb/transaction-after-close-expected.txt: Removed.
platform/wk2/storage/indexeddb/transaction-read-only-expected.txt: Removed.
platform/wk2/storage/indexeddb/version-change-exclusive-expected.txt: Removed.

11:10 AM Changeset in webkit [197121] by ap@apple.com

4 edits in trunk/Tools

Enable MallocScribble when detecting leaks
https://bugs.webkit.org/show_bug.cgi?id=154679

Reviewed by Geoffrey Garen.

Scripts/webkitpy/port/ios.py:

(IOSSimulatorPort.setup_environ_for_server):

Scripts/webkitpy/port/mac.py:

(MacPort.setup_environ_for_server):

Scripts/webkitpy/port/mac_unittest.py:

(MacTest.test_setup_environ_for_server):

8:35 AM Changeset in webkit [197120] by eric.carlson@apple.com

2 edits in trunk/Tools

Unreviewed, fix iOS builds after r197114.

WebKitTestRunner/TestController.cpp:

(WTR::createCanonicalUUIDString):
(WTR::TestController::saltForOrigin):

8:34 AM Changeset in webkit [197119] by Nikita Vasilyev

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Unify selected item colors
https://bugs.webkit.org/show_bug.cgi?id=154668
<rdar://problem/24832178>

Reviewed by Timothy Hatcher.

Use the same CSS variable color for all selected items.

UserInterface/Views/TreeOutline.css:

(.tree-outline:matches(:focus, .force-focus) .item.selected):

UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.css:

UserInterface/Views/VisualStyleSelectorTreeItem.css:

(.item.visual-style-selector-item.selected):

UserInterface/Views/VisualStyleTabbedPropertiesRow.css:

(.visual-style-tabbed-properties-row > .visual-style-tabbed-properties-row-container > button.selected):

8:21 AM Changeset in webkit [197118] by dbates@webkit.org

22 edits
1 copy
1 add in trunk

CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
https://bugs.webkit.org/show_bug.cgi?id=154522
<rdar://problem/24762078>

Reviewed by Brent Fulgham.

Source/WebCore:

Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.
dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.
dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this

code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent
to support attributes statusCode and columnNumebr.

dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.
page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent
and send a violation report (if applicable).

LayoutTests:

TestExpectations: Mark tests http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation*.html as PASS

so that we run them.

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt: Update expected result to

reflect failing sub-test. We do not support the experimental JavaScript event listener onsecuritypolicyviolation when
building with ENABLE(CSP_NEXT) disabled.

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Update line and column numbers.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt: Added.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html: Added.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html: Update line and column numbers.
js/dom/global-constructors-attributes-expected.txt: Update expected results now that we expose SecurityPolicyViolationEvent.
platform/efl/js/dom/global-constructors-attributes-expected.txt: Ditto.
platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt: Ditto.
platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt: Ditto.
platform/mac/js/dom/global-constructors-attributes-expected.txt: Ditto.

8:21 AM Changeset in webkit [197117] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.12/Source

Merge r197062 - [GTK] Tearing when entering AC mode
https://bugs.webkit.org/show_bug.cgi?id=150955

Reviewed by Michael Catanzaro.

Source/WebCore:

platform/gtk/GtkUtilities.cpp:

(WebCore::widgetIsOnscreenToplevelWindow): Allow passing nullptr.

Source/WebKit2:

When entering accelerated compositing mode, we keep rendering the
non accelerated contents until we have the first frame of
accelerated compositing contents. When the view is created hidden,
for example when the browser opens a link in a new tab, the view
is not realized until it is mapped. The native surface handle for
compositing, needed by the web process to render accelerated
compositing contents, is not available until the view is realized,
because it depends on the properties of the parent. When a web
view is mapped for the first time, and then realized, we send the
native surface handle for compositing to the web process, and keep
rendering the non composited contents until we get the first
frame, but in this case we never had non composited contents and
we end up rendering an untinitalized surface. This sometimes just
produces flickering and sometimes rendering artifacts.
We can prevent this from happening by realizing the web view as
soon as possible. A GtkWidget can't be realized until it has been
added to a toplevel, so we can realize our view right after it is
added to a toplevel window, and wait until the view is actually
mapped to notify the web process that it has been added to a
window. This way can we enter accelerated compositing mode before
the web view is mapped, so that when mapped we don't try to paint
the previous contents and don't need to wait for the first frame.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(toplevelWindowFocusInEvent): Handle the case of the window being
hidden when receiving focus in. According to
gtk_window_focus_in_event, this can happen.
(webkitWebViewBaseSetToplevelOnScreenWindow): When the web view is
removed from its toplevel parent, update the IsInWindow and
WindowIsActive flags accordingly. When the view is added to a
toplevel, realize it and don't update the window flags, they will be
updated when the view is mapped the first time.
(webkitWebViewBaseMap): Also update IsInWindow and WindowIsActive
flags if needed. This way, if for example you open a youtube video
in a new tab, the video won't start playing until you visit the
tab, like we did when the view was realized on map.
(webkitWebViewBaseHierarchyChanged): Use hierarchy-changed signal
instead of parent-set to be notified when the view is added to or
removed from a toplevel.
(webkit_web_view_base_class_init): Implement hierarchy-changed
instead of parent-set.
(webkitWebViewBaseRealize): Do not call
webkitWebViewBaseSetToplevelOnScreenWindow on realize, it's now
webkitWebViewBaseSetToplevelOnScreenWindow the one realizing the view.

UIProcess/cairo/BackingStoreCairo.cpp:

(WebKit::BackingStore::createBackend): Do not realize the view
here, it should be realized already at this point. If it's not
realized at this point is because it hasn't been added to a
toplevel and gtk_widget_realize will not work anyway.
(WebKit::BackingStore::paint): This is changing the cairo source
operator, so save/restore the cairo context to ensure it doesn't
affect other drawing done after this.

8:19 AM Changeset in webkit [197116] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r197057 - Modern IDB: Some w3c objectstore tests crash under GuardMalloc.
https://bugs.webkit.org/show_bug.cgi?id=154460

Reviewed by Alex Christensen.

No new tests (Covered by existing tests).

Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
(WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
(WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore): Don't delete the UniqueIDBDatabase yet

if there are still any connections pending close.

(WebCore::IDBServer::UniqueIDBDatabase::didPerformCommitTransaction):
(WebCore::IDBServer::UniqueIDBDatabase::didPerformAbortTransaction):
(WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted): It's possible that with this

transaction completing, and a connection finished its close process, that the UniqueIDBDatabase is
now ready to be deleted.

Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:

(WebCore::IDBServer::UniqueIDBDatabaseConnection::abortTransactionWithoutCallback):

Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:

Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:

(WebCore::IDBServer::UniqueIDBDatabaseTransaction::abortWithoutCallback):

8:18 AM Changeset in webkit [197115] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197037 - Stackmaps have problems with double register constraints
https://bugs.webkit.org/show_bug.cgi?id=154643

Reviewed by Geoffrey Garen.

This is currently a benign bug. I found it while playing.

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::fillStackmap):

b3/testb3.cpp:

(JSC::B3::testURShiftSelf64):
(JSC::B3::testPatchpointDoubleRegs):
(JSC::B3::zero):
(JSC::B3::run):

7:18 AM Changeset in webkit [197114] by eric.carlson@apple.com

55 edits
7 adds in trunk

[MediaStream] MediaDeviceInfo deviceId and groupId must be unique to the page's origin
https://bugs.webkit.org/show_bug.cgi?id=153163
<rdar://problem/24334526>

Reviewed by Tim Horton.

Source/WebCore:

Tests: http/tests/media/media-stream/enumerate-devices-source-id-persistent.html

http/tests/media/media-stream/enumerate-devices-source-id.html

Modules/mediastream/MediaDevicesRequest.cpp:

(WebCore::MediaDevicesRequest::start): Don't check document.hasHadActiveMediaStreamTrack, do it

in didCompleteTrackSourceInfoRequest where we need the information.

(WebCore::MediaDevicesRequest::didCompletePermissionCheck): Renamed from didCompleteCheck, save

device ID hash string.

(WebCore::hashString): Hash a string with SHA1.
(WebCore::MediaDevicesRequest::hashID): Hash and ID.
(WebCore::MediaDevicesRequest::didCompleteTrackSourceInfoRequest): Hash deviceId and groupId.
(WebCore::MediaDevicesRequest::didCompleteCheck): Deleted.
(WebCore::MediaDevicesRequest::getTrackSources): Deleted.
(WebCore::MediaDevicesRequest::didCompleteRequest): Deleted.

Modules/mediastream/MediaDevicesRequest.h:

Modules/mediastream/UserMediaPermissionCheck.cpp:

(WebCore::UserMediaPermissionCheck::userMediaDocumentOrigin): Renamed from securityOrigin.
(WebCore::UserMediaPermissionCheck::topLevelDocumentOrigin): New, return the top level document origin.
(WebCore::UserMediaPermissionCheck::setUserMediaAccessInfo): Renamed from setHasPersistentPermission.
(WebCore::UserMediaPermissionCheck::securityOrigin): Deleted.
(WebCore::UserMediaPermissionCheck::setHasPersistentPermission): Deleted.

Modules/mediastream/UserMediaPermissionCheck.h:

Modules/mediastream/UserMediaRequest.cpp:

(WebCore::UserMediaRequest::userMediaDocumentOrigin): Renamed from securityOrigin.
(WebCore::UserMediaRequest::topLevelDocumentOrigin): New, return the top level document origin.
(WebCore::UserMediaRequest::securityOrigin): Deleted.

Modules/mediastream/UserMediaRequest.h:

(WebCore::UserMediaRequest::requiresAudio): Deleted, unused.
(WebCore::UserMediaRequest::requiresVideo): Ditto.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::mediaPlayerMediaDeviceIdentifierStorageDirectory): Deleted, unused.

html/HTMLMediaElement.h:

platform/graphics/MediaPlayer.h:

(WebCore::MediaPlayerClient::mediaPlayerMediaDeviceIdentifierStorageDirectory): Deleted.

platform/mediastream/MediaStreamTrackSourcesRequestClient.h:

(WebCore::MediaStreamTrackSourcesRequestClient::didCompleteTrackSourceInfoRequest): Renamed from didCompleteRequest.

platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:

(WebCore::RealtimeMediaSourceCenterMac::getMediaStreamTrackSources): Ditto.

platform/mock/MockRealtimeMediaSourceCenter.cpp:

(WebCore::MockRealtimeMediaSourceCenter::getMediaStreamTrackSources): Ditto.

Source/WebKit/mac:

WebCoreSupport/WebUserMediaClient.mm:

(WebUserMediaClient::requestUserMediaAccess):
(WebUserMediaClient::checkUserMediaPermission):
(-[WebUserMediaPolicyCheckerListener allow]):
(-[WebUserMediaPolicyCheckerListener deny]):

Source/WebKit2:

CMakeLists.txt: Add WKFrameHandleRef.cpp.

Shared/API/c/WKBase.h: Add WKFrameHandleRef.
UIProcess/API/APIUIClient.h:

(API::UIClient::decidePolicyForUserMediaPermissionRequest): Add parameter top level document

security context.

(API::UIClient::checkUserMediaPermissionForOrigin): Ditto.

UIProcess/API/C/WKAPICast.h: Add FrameHandle.

UIProcess/API/C/WKFrameHandleRef.cpp: Added.
UIProcess/API/C/WKFrameHandleRef.h: Added.

UIProcess/API/C/WKFrameInfoRef.cpp:

(WKFrameInfoGetFrameHandleRef): Added.

UIProcess/API/C/WKFrameInfoRef.h:

UIProcess/API/C/WKPage.cpp:

(WKPageSetPageUIClient): Add parameters to decidePolicyForUserMediaPermissionRequest and

checkUserMediaPermissionForOrigin for top level document security context.

UIProcess/API/C/WKPageUIClient.h: Ditto.

UIProcess/API/C/WKUserMediaPermissionCheck.cpp:

(WKUserMediaPermissionCheckSetUserMediaAccessInfo): Renamed from WKUserMediaPermissionCheckSetHasPersistentPermission,

add parameter for top level document security context.

(WKUserMediaPermissionCheckSetHasPersistentPermission): Deleted.

UIProcess/API/C/WKUserMediaPermissionCheck.h:

UIProcess/API/gtk/WebKitUserMediaPermissionRequest.cpp:

(webkitUserMediaPermissionRequestCreate): Add top level document origin.

UIProcess/UserMediaPermissionCheckProxy.cpp:

(WebKit::UserMediaPermissionCheckProxy::setUserMediaAccessInfo): Renamed from setHasPersistentPermission.
(WebKit::UserMediaPermissionCheckProxy::setHasPersistentPermission): Deleted.

UIProcess/UserMediaPermissionCheckProxy.h:

UIProcess/UserMediaPermissionRequestManagerProxy.cpp:

(WebKit::UserMediaPermissionRequestManagerProxy::didCompleteUserMediaPermissionCheck): Add parameter

for device id hash salt.

UIProcess/UserMediaPermissionRequestManagerProxy.h:

UIProcess/UserMediaPermissionRequestProxy.h:

(WebKit::UserMediaPermissionRequestProxy::requiresAudio): Deleted, unused.
(WebKit::UserMediaPermissionRequestProxy::requiresVideo): Ditto.
(WebKit::UserMediaPermissionRequestProxy::firstVideoDeviceUID): Ditto.
(WebKit::UserMediaPermissionRequestProxy::firstAudioDeviceUID): Ditto.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::requestUserMediaPermissionForFrame): Pass through parameter for top

level document security context.

(WebKit::WebPageProxy::checkUserMediaPermissionForFrame): Ditto.

UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:

WebKit2.xcodeproj/project.pbxproj: Add WKFrameHandleRef.cpp|.h.

WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp:

(WebKit::UserMediaPermissionRequestManager::startUserMediaRequest): Pass through parameter for top

level document security context.

(WebKit::UserMediaPermissionRequestManager::startUserMediaPermissionCheck): Ditto.
(WebKit::UserMediaPermissionRequestManager::didCompleteUserMediaPermissionCheck): Pass through

device id hash salt.

WebProcess/MediaStream/UserMediaPermissionRequestManager.h:

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::didCompleteUserMediaPermissionCheck): Ditto.

WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:

Tools:

WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:

(WTR::InjectedBundle::setUserMediaPermissionForOrigin): Take top level document origin.

WebKitTestRunner/InjectedBundle/InjectedBundle.h:

WebKitTestRunner/InjectedBundle/TestRunner.cpp:

(WTR::TestRunner::setUserMediaPermissionForOrigin): Ditto.

WebKitTestRunner/InjectedBundle/TestRunner.h:

WebKitTestRunner/TestController.cpp:

(WTR::decidePolicyForUserMediaPermissionRequest): Pass through top level document origin.
(WTR::checkUserMediaPermissionForOrigin): Ditto.
(WTR::TestController::resetStateToConsistentValues): m_userMediaOriginPermissions -> m_cahcedUserMediaPermissions.
(WTR::originUserVisibleName): Return a String.
(WTR::userMediaOriginHash): Create a hash of the origin plus top level document origin.
(WTR::TestController::saltForOrigin): Return salt for an origin.
(WTR::TestController::setUserMediaPermissionForOrigin): Return permission for an origin.
(WTR::TestController::handleCheckOfUserMediaPermissionForOrigin):
(WTR::TestController::handleUserMediaPermissionRequest):
(WTR::TestController::decidePolicyForUserMediaPermissionRequestIfPossible):
(WTR::OriginSettings::OriginSettings): New, class to cache settings for an origin.
(WTR::OriginSettings::persistentPermission): Persistent permissions for origin.
(WTR::OriginSettings::setPersistentPermission): Set permissions for origin.
(WTR::OriginSettings::persistentSalt): Return the persistent salt for the origin, if any.
(WTR::OriginSettings::setPersistentSalt): Set the persistent salt for the origin
(WTR::OriginSettings::ephemeralSalts): Return hashmap used to store per-frame salts.

WebKitTestRunner/TestController.h:

WebKitTestRunner/TestInvocation.cpp:

(WTR::TestInvocation::didReceiveMessageFromInjectedBundle):

LayoutTests:

fast/mediastream/MediaDevices-enumerateDevices-expected.txt:
fast/mediastream/MediaDevices-enumerateDevices.html:
http/tests/media/media-stream/enumerate-devices-source-id-expected.txt: Added.
http/tests/media/media-stream/enumerate-devices-source-id-persistent-expected.txt: Added.
http/tests/media/media-stream/enumerate-devices-source-id-persistent.html: Added.
http/tests/media/media-stream/enumerate-devices-source-id.html: Added.
http/tests/media/media-stream/resources/enumerate-devices-source-id-frame.html: Added.

7:05 AM Changeset in webkit [197113] by Carlos Garcia Campos

8 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r197030 - Background of an absolutely positioned inline element inside text-indented parent is positioned statically.
https://bugs.webkit.org/show_bug.cgi?id=154019

Reviewed by Simon Fraser.

This patch ensures that statically positioned out-of-flow renderers are also text-aligned
even when none of the renderers on the first line generate a linebox (so we end up with no bidi runs at all).
The fix is to pass IndentTextOrNot information to startAlignedOffsetForLine through updateStaticInlinePositionForChild
so that we can compute the left position for this statically positioned out of flow renderer.

Source/WebCore:

Test: fast/css3-text/css3-text-indent/text-indent-with-absolute-pos-child.html

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::adjustPositionedBlock):
(WebCore::RenderBlockFlow::updateStaticInlinePositionForChild):

rendering/RenderBlockFlow.h:
rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
(WebCore::RenderBlockFlow::startAlignedOffsetForLine):

rendering/line/LineBreaker.cpp:

(WebCore::LineBreaker::skipTrailingWhitespace):
(WebCore::LineBreaker::skipLeadingWhitespace):

rendering/line/LineInlineHeaders.h: webkit.org/b/154628 fixes the bool vs IndentTextOrNot issue.

(WebCore::setStaticPositions):

LayoutTests:

fast/css3-text/css3-text-indent/text-indent-with-absolute-pos-child-expected.html: Added.
fast/css3-text/css3-text-indent/text-indent-with-absolute-pos-child.html: Added.

7:04 AM Changeset in webkit [197112] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r197024 - REGRESSION(r195949): [GTK] Test /webkit2/WebKitWebView/insert/link is failing since r195949
https://bugs.webkit.org/show_bug.cgi?id=153747

Reviewed by Michael Catanzaro.

Source/WebCore:

Do not return early when reaching a boundary if there's a range
selection. In that case, the selection will be cleared and
accessibility will be notified.

Test: editing/selection/move-to-line-boundary-clear-selection.html

editing/FrameSelection.cpp:

(WebCore::FrameSelection::modify):

LayoutTests:

Add test to check that moving to line boundary clears the
selection even if the cursor is already at the boundary.

editing/selection/move-to-line-boundary-clear-selection-expected.txt: Added.
editing/selection/move-to-line-boundary-clear-selection.html: Added.

6:59 AM Changeset in webkit [197111] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r197001 - JSC stress tests' standalone-pre.js should exit on the first failure by default
https://bugs.webkit.org/show_bug.cgi?id=154565

Reviewed by Mark Lam.

Currently, if a test writer does not call finishJSTest() at the end of
any test using stress/resources/standalone-pre.js then the test can fail
without actually reporting an error to the harness. By default, we
should throw on the first error so, in the event someone does not call
finishJSTest() the harness will still notice the error.

tests/stress/regress-151324.js:
tests/stress/resources/standalone-pre.js:

(testFailed):

6:48 AM Changeset in webkit [197110] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r196999 - Make JSObject::getMethod have fewer branches
https://bugs.webkit.org/show_bug.cgi?id=154603

Reviewed by Mark Lam.

Writing code with fewer branches is almost always better.

runtime/JSObject.cpp:

(JSC::JSObject::getMethod):

6:40 AM Changeset in webkit [197109] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r196996 - B3::Value doesn't self-destruct virtually enough (Causes many leaks in LowerDFGToB3::appendOSRExit)
https://bugs.webkit.org/show_bug.cgi?id=154592

Reviewed by Saam Barati.

If Foo has a virtual destructor, then:

foo->Foo::~Foo() does a non-virtual call to Foo's destructor. Even if foo points to a
subclass of Foo that overrides the destructor, this syntax will not call that override.

foo->~Foo() does a virtual call to the destructor, and so if foo points to a subclass, you
get the subclass's override.

In B3, we used this->Value::~Value() thinking that it would call the subclass's override.
This caused leaks because this didn't actually call the subclass's override. This fixes the
problem by using this->~Value() instead.

b3/B3ControlValue.cpp:

(JSC::B3::ControlValue::convertToJump):
(JSC::B3::ControlValue::convertToOops):

b3/B3Value.cpp:

(JSC::B3::Value::replaceWithIdentity):
(JSC::B3::Value::replaceWithNop):
(JSC::B3::Value::replaceWithPhi):

6:29 AM Changeset in webkit [197108] by Carlos Garcia Campos

14 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r196991 - Lay the groundwork for more constness in StyleResolver-related code
https://bugs.webkit.org/show_bug.cgi?id=154598

Reviewed by Antti Koivisto.

Make some of the leaf functions that are used by the style resolver take
const CSSValues, and use 'auto' more to automatically get const stack variables
when appropriate.

css/CSSBorderImageSliceValue.h:

(WebCore::CSSBorderImageSliceValue::slices):

css/CSSPrimitiveValue.h:

(WebCore::CSSPrimitiveValue::isQuirkValue):

css/FontVariantBuilder.cpp:

(WebCore::extractFontVariantLigatures):
(WebCore::extractFontVariantNumeric):
(WebCore::extractFontVariantEastAsian):

css/FontVariantBuilder.h:
css/StyleBuilderConverter.h:

(WebCore::StyleBuilderConverter::convertReflection):
(WebCore::StyleBuilderConverter::convertGridAutoFlow):

css/StyleBuilderCustom.h:

(WebCore::StyleBuilderCustom::applyValueSize):
(WebCore::StyleBuilderCustom::applyValueStroke):

css/StyleResolver.cpp:

(WebCore::StyleResolver::colorFromPrimitiveValueIsDerivedFromElement):
(WebCore::StyleResolver::colorFromPrimitiveValue):
(WebCore::StyleResolver::createFilterOperations):

css/StyleResolver.h:
css/TransformFunctions.cpp:

(WebCore::transformsForValue):

css/TransformFunctions.h:
rendering/style/StylePendingImage.h:
svg/SVGLength.cpp:

(WebCore::SVGLength::fromCSSPrimitiveValue):

svg/SVGLength.h:

6:18 AM Changeset in webkit [197107] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/LayoutTests

Merge r196988 - REGRESSION (r192251): http/tests/navigation/page-cache-xhr.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=154589

Reviewed by Youenn Fablet.

http/tests/navigation/page-cache-xhr.html: Load a file that exists. The content

doesn't matter, as we expect to navigate away before the load occurs.

http/tests/resources/load-and-stall.cgi: Added cache control, just for a good measure.

6:15 AM Changeset in webkit [197106] by Carlos Garcia Campos

29 edits
1 add in releases/WebKitGTK/webkit-2.12

Merge r196986 - Debug assertion failure while loading http://kangax.github.io/compat-table/es6/.
https://bugs.webkit.org/show_bug.cgi?id=154542

Reviewed by Saam Barati.

Source/JavaScriptCore:

According to the spec, the constructors of the following types "are not intended
to be called as a function and will throw an exception". These types are:

TypedArrays - https://tc39.github.io/ecma262/#sec-typedarray-constructors
Map - https://tc39.github.io/ecma262/#sec-map-constructor
Set - https://tc39.github.io/ecma262/#sec-set-constructor
WeakMap - https://tc39.github.io/ecma262/#sec-weakmap-constructor
WeakSet - https://tc39.github.io/ecma262/#sec-weakset-constructor
ArrayBuffer - https://tc39.github.io/ecma262/#sec-arraybuffer-constructor
DataView - https://tc39.github.io/ecma262/#sec-dataview-constructor
Promise - https://tc39.github.io/ecma262/#sec-promise-constructor
Proxy - https://tc39.github.io/ecma262/#sec-proxy-constructor

This patch does the foillowing:

Ensures that these constructors can be called but will throw a TypeError when called.
Makes all these objects use throwConstructorCannotBeCalledAsFunctionTypeError() in their implementation to be consistent.
Change the error message to "calling XXX constructor without new is invalid". This is clearer because the error is likely due to the user forgetting to use the new operator on these constructors.

runtime/Error.h:
runtime/Error.cpp:

(JSC::throwConstructorCannotBeCalledAsFunctionTypeError):

Added a convenience function to throw the TypeError.

runtime/JSArrayBufferConstructor.cpp:

(JSC::constructArrayBuffer):
(JSC::callArrayBuffer):
(JSC::JSArrayBufferConstructor::getCallData):

runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::callGenericTypedArrayView):
(JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):

runtime/JSPromiseConstructor.cpp:

(JSC::callPromise):

runtime/MapConstructor.cpp:

(JSC::callMap):

runtime/ProxyConstructor.cpp:

(JSC::callProxy):
(JSC::ProxyConstructor::getCallData):

runtime/SetConstructor.cpp:

(JSC::callSet):

runtime/WeakMapConstructor.cpp:

(JSC::callWeakMap):

runtime/WeakSetConstructor.cpp:

(JSC::callWeakSet):

tests/es6.yaml:
The typed_arrays_%TypedArray%[Symbol.species].js test now passes.

tests/stress/call-non-calleable-constructors-as-function.js: Added.

(test):

tests/stress/map-constructor.js:

(testCallTypeError):

tests/stress/promise-cannot-be-called.js:

(shouldThrow):

tests/stress/proxy-basic.js:
tests/stress/set-constructor.js:
tests/stress/throw-from-ftl-call-ic-slow-path-cells.js:

(i.catch):

tests/stress/throw-from-ftl-call-ic-slow-path-undefined.js:

(i.catch):

tests/stress/throw-from-ftl-call-ic-slow-path.js:

(i.catch):

tests/stress/weak-map-constructor.js:

(testCallTypeError):

tests/stress/weak-set-constructor.js:
Updated error message string.

LayoutTests:

js/Promise-types-expected.txt:
js/basic-map-expected.txt:
js/basic-set-expected.txt:
js/dom/basic-weakmap-expected.txt:
js/dom/basic-weakset-expected.txt:
js/script-tests/Promise-types.js:
js/typedarray-constructors-expected.txt:
Updated error message string.

5:56 AM Changeset in webkit [197105] by Carlos Garcia Campos

15 edits
3 adds in releases/WebKitGTK/webkit-2.12

Merge r196977 - [SVG] Update SVG source to return string literals as ASCIILiteral and add test cases for case sensitivity
https://bugs.webkit.org/show_bug.cgi?id=154373

Patch by Nikos Andronikos <nikos.andronikos-webkit@cisra.canon.com.au> on 2016-02-23
Reviewed by Youenn Fablet.

Source/WebCore:

Update SVGAnimatedEnumeration toString method to return ASCIILiteral for string literals and add test cases for
case-sensitivity for these elements.

Test: svg/dom/SVGAnimatedEnumeration-case-sensitive.html

svg/SVGComponentTransferFunctionElement.h:

(WebCore::SVGPropertyTraits<ComponentTransferType>::toString):

svg/SVGFEBlendElement.h:

(WebCore::SVGPropertyTraits<BlendMode>::toString):

svg/SVGFEColorMatrixElement.h:

(WebCore::SVGPropertyTraits<ColorMatrixType>::toString):

svg/SVGFECompositeElement.h:

(WebCore::SVGPropertyTraits<CompositeOperationType>::toString):

svg/SVGFEConvolveMatrixElement.h:

(WebCore::SVGPropertyTraits<EdgeModeType>::toString):

svg/SVGFEDisplacementMapElement.h:

(WebCore::SVGPropertyTraits<ChannelSelectorType>::toString):

svg/SVGFEMorphologyElement.h:

(WebCore::SVGPropertyTraits<MorphologyOperatorType>::toString):

svg/SVGFETurbulenceElement.h:

(WebCore::SVGPropertyTraits<SVGStitchOptions>::toString):
(WebCore::SVGPropertyTraits<TurbulenceType>::toString):

svg/SVGGradientElement.h:

(WebCore::SVGPropertyTraits<SVGSpreadMethodType>::toString):

svg/SVGMarkerElement.h:

(WebCore::SVGPropertyTraits<SVGMarkerUnitsType>::toString):

svg/SVGTextContentElement.h:

(WebCore::SVGPropertyTraits<SVGLengthAdjustType>::toString):

svg/SVGTextPathElement.h:

(WebCore::SVGPropertyTraits<SVGTextPathMethodType>::toString):
(WebCore::SVGPropertyTraits<SVGTextPathSpacingType>::toString):

svg/SVGUnitTypes.h:

(WebCore::SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::toString):

LayoutTests:

Add test cases for case-sensitivity for SVGAnimatedEnumeration elements.

svg/dom/SVGAnimatedEnumeration-case-sensitive-expected.txt: Added.
svg/dom/SVGAnimatedEnumeration-case-sensitive.html: Added.
svg/dom/script-tests/SVGAnimatedEnumeration-case-sensitive.js: Added.

(testCaseSensitivity):

5:49 AM Changeset in webkit [197104] by Carlos Garcia Campos

6 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r196971 - Some timer alignment cleanup.
https://bugs.webkit.org/show_bug.cgi?id=154559

Reviewed by Chris Dumez.

Document shouldn't override Page's timer alignment policy with a lower alignment,
and m_domTimerAlignmentInterval isn't really a Settings, it's just the current state
for the page.

dom/Document.cpp:

(WebCore::Document::timerAlignmentInterval):

take the max of the possible intervals.

page/Page.cpp:

(WebCore::Page::Page):
(WebCore::Page::setTimerThrottlingEnabled):
(WebCore::Page::setDOMTimerAlignmentInterval):

moved here from Settings.

page/Page.h:

(WebCore::Page::domTimerAlignmentInterval):

moved here from Settings.

page/Settings.cpp:

(WebCore::Settings::setDOMTimerAlignmentInterval): Deleted.

moved to Page.

page/Settings.h:

(WebCore::Settings::domTimerAlignmentInterval): Deleted.

moved to Page.

5:40 AM Changeset in webkit [197103] by Carlos Garcia Campos

13 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r196969 - Font features specified in @font-face blocks don't apply to local() families
https://bugs.webkit.org/show_bug.cgi?id=154554

Reviewed by Dean Jackson.

Source/WebCore:

The correct variables just need to be wired up. In addition, our caches need to be sensitive
to the new data.

Test: css3/font-feature-font-face-local.html

css/CSSFontFaceSource.cpp:

(WebCore::CSSFontFaceSource::font):

platform/graphics/FontCache.cpp:

(WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
(WebCore::FontPlatformDataCacheKey::operator==):
(WebCore::FontPlatformDataCacheKeyHash::hash):
(WebCore::FontCache::getCachedFontPlatformData):
(WebCore::FontCache::fontForFamily):

platform/graphics/FontCache.h:
platform/graphics/FontFeatureSettings.h:

(WebCore::FontFeature::operator!=):
(WebCore::FontFeatureSettings::operator!=):

platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::fontWithFamily):
(WebCore::FontCache::createFontPlatformData):

platform/graphics/mac/ComplexTextControllerCoreText.mm:

(WebCore::ComplexTextController::collectComplexTextRunsForCharacters):

platform/graphics/mac/FontCacheMac.mm:

(WebCore::FontCache::lastResortFallbackFont):

platform/text/TextFlags.h:

(WebCore::FontVariantSettings::operator==):
(WebCore::FontVariantSettings::operator!=):
(WebCore::FontVariantSettings::uniqueValue):

LayoutTests:

css3/font-feature-font-face-local-expected.html: Added.
css3/font-feature-font-face-local.html: Added.

5:24 AM Changeset in webkit [197102] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Web Inspector: Timelines sidebar and overview attempt to access undefined properties when FPS instrument is absent
https://bugs.webkit.org/show_bug.cgi?id=154567
<rdar://problem/24781536>

Reviewed by Joseph Pecoraro.

UserInterface/Views/TimelineOverview.js:

(WebInspector.TimelineOverview):
The viewMode property should be in a valid state before attempting
to access the current view mode settings.

UserInterface/Views/TimelineSidebarPanel.js:

(WebInspector.TimelineSidebarPanel.prototype.get minimumWidth):
(WebInspector.TimelineSidebarPanel.prototype._updateViewModeIfNeeded):
(WebInspector.TimelineSidebarPanel):
Added missing checks for FPSInstrument support.

5:21 AM Changeset in webkit [197101] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r196967 - JSGlobalObject doesn't visit ProxyObjectStructure during GC
https://bugs.webkit.org/show_bug.cgi?id=154564

Rubber stamped by Mark Lam.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::visitChildren):

5:07 AM Changeset in webkit [197100] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r196965 - REGRESSION (r196892): Crash in DocumentLoader::startLoadingMainResource()
https://bugs.webkit.org/show_bug.cgi?id=154563
<rdar://problem/24780678>

Reviewed by Alexey Proskuryakov.

Fixes an issue where the provisional loader may be deallocated when starting
a load. One example where this can occur is when cancelling the provisional load
as part of a form submission because the Content Security Policy of the page
blocks the submission (it violates the directive form-action).

This crash is covered by the test http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html.

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::startLoadingMainResource): Take a ref before calling
DocumentLoader::willSendRequest().

5:05 AM Changeset in webkit [197099] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r196962 - Fix build and implement functions to retrieve registers on FreeBSD
https://bugs.webkit.org/show_bug.cgi?id=152258

Patch by Ting-Wei Lan <Ting-Wei Lan> on 2016-02-22
Reviewed by Michael Catanzaro.

heap/MachineStackMarker.cpp:

(pthreadSignalHandlerSuspendResume):
struct ucontext is not specified in POSIX and it is not available on
FreeBSD. Replacing it with ucontext_t fixes the build problem.
(JSC::MachineThreads::Thread::Registers::stackPointer):
(JSC::MachineThreads::Thread::Registers::framePointer):
(JSC::MachineThreads::Thread::Registers::instructionPointer):
(JSC::MachineThreads::Thread::Registers::llintPC):

heap/MachineStackMarker.h:

4:49 AM Changeset in webkit [197098] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.12

Merge r196961 - REGRESSION (r196563): Images not loading on https://klim.co.nz/blog/paypal-sans-design-information/
https://bugs.webkit.org/show_bug.cgi?id=154547
<rdar://problem/24772167>

Reviewed by Gavin Barraclough.

Source/WebCore:

The Website was doing the following:
$ var e = window.addEventListener;
$ e("eventname", handler)

In such case, the jsEventTargetPrototypeFunctionDispatchEvent() bindings
implementation was caused with a thisValue which is a JSLexicalEnvironment
and the implementation did not know how to convert it into a global object.
The previous implementation on JSDOMWindow used to handle tis correctly
because it was always calling JSValue::toThis() on the thisValue before
trying to cast it to a JSDOMWindow, and JSLexicalEnvironment::toThis()
gets the globalThisValue. This patch updates the EventTarget bindings
code to call always call toThis() on the thisValue before trying to
cast it. This should correctly deal with JSLexicalEnvironment and be a
no-op in usual cases.

No new tests, extended existing test.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateFunctionCastedThis):

LayoutTests:

Add regression test for <rdar://problem/24772167>.

fast/dom/Window/addEventListener-implicit-this-expected.txt:
fast/dom/Window/addEventListener-implicit-this.html:

4:01 AM Changeset in webkit [197097] by Carlos Garcia Campos

10 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r196960 - Repeated background images have the wrong position when using bottom/right-relative background-position
https://bugs.webkit.org/show_bug.cgi?id=154478

Reviewed by Dave Hyatt.
Source/WebCore:

Fix RenderBoxModelObject::calculateBackgroundImageGeometry() to use the right position when
painting repeated background images when right/bottom edges are used.

Also rename BackgroundEdgeOrigin to Edge

Test: fast/images/background-position.html

css/CSSPrimitiveValueMappings.h:

(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator Edge):
(WebCore::CSSPrimitiveValue::operator BackgroundEdgeOrigin): Deleted.

rendering/RenderBoxModelObject.cpp:

(WebCore::resolveEdgeRelativeLength):
(WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):

rendering/style/FillLayer.cpp:

(WebCore::FillLayer::FillLayer):

rendering/style/FillLayer.h:

(WebCore::FillLayer::backgroundXOrigin):
(WebCore::FillLayer::backgroundYOrigin):
(WebCore::FillLayer::setBackgroundXOrigin):
(WebCore::FillLayer::setBackgroundYOrigin):

rendering/style/RenderStyleConstants.cpp:

(WebCore::operator<<):

rendering/style/RenderStyleConstants.h:

LayoutTests:

Enhanced background-position-serialize.html to test values that use right/bottom edge specifiers.

Ref test for background-position.

fast/css/background-position-serialize-expected.txt:
fast/css/background-position-serialize.html:
fast/images/background-position-expected.html: Added.
fast/images/background-position.html: Added.
fast/images/resources/checker.png: Added.

3:42 AM Changeset in webkit [197096] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r196957 - [l10n] Updated Polish translation of WebKitGTK+ for 2.12
https://bugs.webkit.org/show_bug.cgi?id=154549

Patch by Piotr Drąg <piotrdrag@gmail.com> on 2016-02-22
Rubber-stamped by Michael Catanzaro.

pl.po:

3:40 AM Changeset in webkit [197095] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Revert "Merge r196948 - [JSC shell] Don't put empty arguments array to VM."

This reverts commit 634b8dad527aaab26af7e3baaea9d1289b443b37.

3:08 AM Changeset in webkit [197094] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r196948 - [JSC shell] Don't put empty arguments array to VM.
https://bugs.webkit.org/show_bug.cgi?id=154516

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-22
Reviewed by Geoffrey Garen.

This allows arrowfunction-lexical-bind-arguments-top-level test to pass
in jsc as well as in browser.

Source/JavaScriptCore:

jsc.cpp:

(GlobalObject::finishCreation):

LayoutTests:

js/script-tests/arrowfunction-lexical-bind-arguments-top-level.js:

Removed @ skip annotation.

3:08 AM Changeset in webkit [197093] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r196936 - REGRESSION (r196620): Web Inspector: Filter bar in the left sidebar is 1px shorter than the console prompt
https://bugs.webkit.org/show_bug.cgi?id=154529

Reviewed by Timothy Hatcher.

UserInterface/Views/NavigationSidebarPanel.css:

(.sidebar > .panel.navigation > .overflow-shadow):

3:05 AM Changeset in webkit [197092] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r196896 - CodeBlock always visits its unlinked code twice
https://bugs.webkit.org/show_bug.cgi?id=154494

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-21
Reviewed by Saam Barati.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::visitChildren):
The unlinked code is always visited in stronglyVisitStrongReferences.

2:51 AM Changeset in webkit [197091] by Carlos Garcia Campos

6 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r196889 - iframe/frame/object.contentDocument should be on the prototype
https://bugs.webkit.org/show_bug.cgi?id=154409

Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Move iframe/frame/object.contentDocument to the prototype. They used
to be on the instance due to the [CheckSecurityForNode] IDL extended
attribute. This patch updates the bindings generator so that such
attributes are now on the prototype. While they are now on the
prototype, the security checks are still generated in the
corresponding getters and setters so cross origin access is still
prevented.

Test: http/tests/security/cross-origin-iframe-contentDocument.html

bindings/scripts/CodeGeneratorJS.pm:

(AttributeShouldBeOnInstance): Deleted.

LayoutTests:

Add test coverage for trying to access iframe.contentDocument cross origin
to make sure it still fails and logs a security error.

http/tests/security/cross-origin-iframe-contentDocument-expected.txt: Added.
http/tests/security/cross-origin-iframe-contentDocument.html: Added.

2:35 AM Changeset in webkit [197090] by youenn.fablet@crf.canon.fr

1 edit
48 copies
3 adds
1 delete in trunk/LayoutTests/imported/w3c

Move streams tests from web-platform-tests/streams-api to web-platform-tests/streams
https://bugs.webkit.org/show_bug.cgi?id=154671

Reviewed by Xabier Rodriguez-Calvar.

This will allow preparing resyncing web-platform-tests.

web-platform-tests/streams/README.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/README.txt.
web-platform-tests/streams/byte-length-queuing-strategy-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/byte-length-queuing-strategy-expected.txt.
web-platform-tests/streams/byte-length-queuing-strategy.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/byte-length-queuing-strategy.html.
web-platform-tests/streams/byte-length-queuing-strategy.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/byte-length-queuing-strategy.js.
web-platform-tests/streams/count-queuing-strategy-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/count-queuing-strategy-expected.txt.
web-platform-tests/streams/count-queuing-strategy.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/count-queuing-strategy.html.
web-platform-tests/streams/count-queuing-strategy.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/count-queuing-strategy.js.
web-platform-tests/streams/readable-streams/bad-strategies-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/bad-strategies-expected.txt.
web-platform-tests/streams/readable-streams/bad-strategies.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/bad-strategies.html.
web-platform-tests/streams/readable-streams/bad-strategies.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/bad-strategies.js.
web-platform-tests/streams/readable-streams/bad-underlying-sources-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/bad-underlying-sources-expected.txt.
web-platform-tests/streams/readable-streams/bad-underlying-sources.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/bad-underlying-sources.html.
web-platform-tests/streams/readable-streams/bad-underlying-sources.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/bad-underlying-sources.js.
web-platform-tests/streams/readable-streams/brand-checks-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/brand-checks-expected.txt.
web-platform-tests/streams/readable-streams/brand-checks.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/brand-checks.html.
web-platform-tests/streams/readable-streams/brand-checks.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/brand-checks.js.
web-platform-tests/streams/readable-streams/cancel-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/cancel-expected.txt.
web-platform-tests/streams/readable-streams/cancel.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/cancel.html.
web-platform-tests/streams/readable-streams/cancel.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/cancel.js.
web-platform-tests/streams/readable-streams/count-queuing-strategy-integration-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/count-queuing-strategy-integration-expected.txt.
web-platform-tests/streams/readable-streams/count-queuing-strategy-integration.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/count-queuing-strategy-integration.html.
web-platform-tests/streams/readable-streams/count-queuing-strategy-integration.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/count-queuing-strategy-integration.js.
web-platform-tests/streams/readable-streams/garbage-collection-1-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-collection-1-expected.txt.
web-platform-tests/streams/readable-streams/garbage-collection-1.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-collection-1.html.
web-platform-tests/streams/readable-streams/garbage-collection-2-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-collection-2-expected.txt.
web-platform-tests/streams/readable-streams/garbage-collection-2.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-collection-2.html.
web-platform-tests/streams/readable-streams/garbage-collection-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-collection-expected.txt.
web-platform-tests/streams/readable-streams/garbage-collection.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-collection.html.
web-platform-tests/streams/readable-streams/garbage-collection.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-collection.js.
web-platform-tests/streams/readable-streams/general-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/general-expected.txt.
web-platform-tests/streams/readable-streams/general.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/general.html.
web-platform-tests/streams/readable-streams/general.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/general.js.
web-platform-tests/streams/readable-streams/pipe-through-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/pipe-through-expected.txt.
web-platform-tests/streams/readable-streams/pipe-through.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/pipe-through.html.
web-platform-tests/streams/readable-streams/pipe-through.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/pipe-through.js.
web-platform-tests/streams/readable-streams/readable-stream-reader-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/readable-stream-reader-expected.txt.
web-platform-tests/streams/readable-streams/readable-stream-reader.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/readable-stream-reader.html.
web-platform-tests/streams/readable-streams/readable-stream-reader.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/readable-stream-reader.js.
web-platform-tests/streams/readable-streams/tee-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/tee-expected.txt.
web-platform-tests/streams/readable-streams/tee.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/tee.html.
web-platform-tests/streams/readable-streams/tee.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/tee.js.
web-platform-tests/streams/readable-streams/templated-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/templated-expected.txt.
web-platform-tests/streams/readable-streams/templated.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/templated.html.
web-platform-tests/streams/readable-streams/templated.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/readable-streams/templated.js.
web-platform-tests/streams/resources/rs-test-templates.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/resources/rs-test-templates.js.
web-platform-tests/streams/resources/rs-utils.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/resources/rs-utils.js.
web-platform-tests/streams/resources/test-initializer.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/resources/test-initializer.js.
web-platform-tests/streams/resources/test-utils.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/streams-api/resources/test-utils.js.

2:28 AM Changeset in webkit [197089] by Carlos Garcia Campos

19 edits in releases/WebKitGTK/webkit-2.12

Merge r197038 - CSP: Enable plugin-types directive by default
https://bugs.webkit.org/show_bug.cgi?id=154420
<rdar://problem/24730322>

Reviewed by Brent Fulgham.

Source/WebCore:

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::isExperimentalDirectiveName): Move plugin-types from the directives considered
experimental to...
(WebCore::isCSPDirectiveName): ...the list of standard directives.
(WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the plugin-types
directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.

LayoutTests:

TestExpectations: Mark http/tests/security/contentSecurityPolicy/1.1/plugintypes*.html tests as PASS so that we run them.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid-expected.txt: Update expected result.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid.html: Call runTests() following changes to multiple-iframe-plugin-test.js.

Also add closing tags for <body> and <html> to make the document well-formed.

http/tests/security/contentSecurityPolicy/1.1/plugintypes-mismatched-data.html: Substitute "Content-Security-Policy" for "X-WebKit-CSP";

no behavior change.

http/tests/security/contentSecurityPolicy/1.1/plugintypes-mismatched-url.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-data.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-url-expected.txt: Update expected result.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-url.html: Substitute "Content-Security-Policy" for "X-WebKit-CSP";

no behavior change.

http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-allowed.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html: Call runTests() following changes to multiple-iframe-plugin-test.js.

Also add closing tags for <body> and <html> to make the document well-formed.

http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-02.html: Ditto.
http/tests/security/contentSecurityPolicy/resources/echo-object-data.pl: Remove logic to support Content Security Policy header X-WebKit-CSP

as it is sufficient to make use of the standardized header Content-Security-Policy.

http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js: Simplify code now that we do not pass query string parameter

experimental to script echo-object-data.pl.
(runTests): Runs all the sub-tests.
(runNextTest.iframe.onload): Formerly named testImpl.iframe.onload.
(runNextTest): Formerly named testImpl. Runs the next sub-test.
(testExperimentalPolicy): Deleted.
(test): Deleted.
(testImpl.iframe.onload): Deleted.
(testImpl): Deleted.
(finishTesting): Deleted.

http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon-expected.txt: Update expected result based on change to test (below).
http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon.html: Modified to test that we emit

a console warning when plugin-types is used as a source expression.

2:27 AM Changeset in webkit [197088] by Carlos Garcia Campos

8 edits
1 copy
8 adds in releases/WebKitGTK/webkit-2.12

Merge r197007 - CSP: Enable base-uri directive by default
https://bugs.webkit.org/show_bug.cgi?id=154521
<rdar://problem/24762032>

Reviewed by Brent Fulgham.

Source/WebCore:

Tests: http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored.html

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny.html

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::isExperimentalDirectiveName): Move base-uri from the directives considered
experimental to...
(WebCore::isCSPDirectiveName): ...the list of standard directives.
(WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the base-uri
directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.

LayoutTests:

Copy test http/tests/security/contentSecurityPolicy/1.1/base-uri-deny.html to
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny.html,
making some minor stylistic changes, and update TestExpectations to skip it because it depends
on the firing of event SecurityPolicyViolationEvent, which is disabled as of the time of writing.
We will enable the firing of this event in <https://bugs.webkit.org/show_bug.cgi?id=154522>.
Repurpose test name base-uri-deny.html to test that the base-uri directive prevents the use of
document base URL without depending on the firing of event SecurityPolicyViolationEvent.

Additionally, add test http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored.html
to ensure that we do not fall back to enforcing the default-src directive in absence of
a base-uri directive as per section base-uri of the Content Security Policy 2.0 spec.,
<https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

TestExpectations:
http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored-expected.txt: Added.
http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored.html: Added.
http/tests/security/contentSecurityPolicy/1.1/base-uri-deny-expected.txt:
http/tests/security/contentSecurityPolicy/1.1/base-uri-deny.html: Repurpose test.
http/tests/security/contentSecurityPolicy/1.1/resources/base-href/resources/safe-script.js: Added.
http/tests/security/contentSecurityPolicy/1.1/resources/safe-script.js: Added.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/base-uri-deny-expected.txt.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny.html: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/base-uri-deny.html.
http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon-expected.txt: Update expected result based on change to test (below).
http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon.html: Modified to test that we emit

a console warning when base-uri is used as a source expression.

2:27 AM Changeset in webkit [197087] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.12

Merge r196992 - REGRESSION (r196892): No longer emit error message when CSP form-action directive is used as a source expression
https://bugs.webkit.org/show_bug.cgi?id=154555
<rdar://problem/24776777>

Reviewed by Andy Estes.

Source/WebCore:

Fixes an issue where an error message is not emitted when directive form-action is used as a
source expression. Prior to <http://trac.webkit.org/changeset/196892>, when directive form-action
was used as a source expression a console error message would be emitted with the form:

The Content Security Policy directive 'script-src' contains 'form-action' as a source expression.
Did you mean 'script-src ...; form-action...' (note the semicolon)?

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::isCSPDirectiveName): Return true if the specified directive name is "form-action".

LayoutTests:

Test that we emit a console error message when form-action is used as a source expression.

http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon-expected.txt:
http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon.html: Use form-action as a

source expression. Also, use a double quoted (") string literal instead of a single quoted (') string
literal to represent the CSP policy so as to avoid the need to escape embedded single quote characters.

2:26 AM Changeset in webkit [197086] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r196892 - CSP: Enable form-action directive by default
https://bugs.webkit.org/show_bug.cgi?id=154520
<rdar://problem/24762029>

Reviewed by Sam Weinig.

Source/WebCore:

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the form-action
directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.
(WebCore::isExperimentalDirectiveName): Remove form-action from the directives considered
experimental.

LayoutTests:

Mark form-action tests as Pass so that we run them.

TestExpectations:

2:26 AM Changeset in webkit [197085] by Carlos Garcia Campos

2 edits
6 moves in releases/WebKitGTK/webkit-2.12/LayoutTests

Merge r196878 - Attempt to fix the Content Extension test failures following <https://trac.webkit.org/changeset/196875>
(https://bugs.webkit.org/show_bug.cgi?id=154307)

Convert Content Extension tests that use the Content Security Policy directive report-uri from HTML files
to PHP scripts and modified them to define the content security policy for the page via the Content-Security-Policy
HTTP header instead of via a meta element so that the report-uri directive is honored. Following
<https://trac.webkit.org/changeset/196875> the directive report-uri is only honored when contained in a
policy that is delivered via an HTTP header. That is, it is no longer honored when delivered in a meta element.

http/tests/contentextensions/block-cookies-in-csp-report.php: Renamed from LayoutTests/http/tests/contentextensions/block-cookies-in-csp-report.html.
http/tests/contentextensions/block-csp-report.php: Renamed from LayoutTests/http/tests/contentextensions/block-csp-report.html.
http/tests/contentextensions/hide-on-csp-report.php: Renamed from LayoutTests/http/tests/contentextensions/hide-on-csp-report.html.

Merge r196879 - Another attempt to fix the Content Extension test failures following <https://trac.webkit.org/changeset/196875>
(https://bugs.webkit.org/show_bug.cgi?id=154307)

Rename Content Extension JSON files so that they are associated with tests http/tests/contentextensions/block-cookies-in-csp-report.php
http/tests/contentextensions/block-csp-report.php and http/tests/contentextensions/hide-on-csp-report.php. These
files were formerly named block-cookies-in-csp-report.html, block-csp-report.html, and hide-on-csp-report.html,
respectively, prior to <https://trac.webkit.org/changeset/196878>. Also, update expected result for test block-csp-report.html
following <https://trac.webkit.org/changeset/196878>.

http/tests/contentextensions/block-cookies-in-csp-report.php.json: Renamed from LayoutTests/http/tests/contentextensions/block-cookies-in-csp-report.html.json.
http/tests/contentextensions/block-csp-report-expected.txt:
http/tests/contentextensions/block-csp-report.php.json: Renamed from LayoutTests/http/tests/contentextensions/block-csp-report.html.json.
http/tests/contentextensions/hide-on-csp-report.php.json: Renamed from LayoutTests/http/tests/contentextensions/hide-on-csp-report.html.json.

2:26 AM Changeset in webkit [197084] by Carlos Garcia Campos

6 edits in releases/WebKitGTK/webkit-2.12

Merge r196877 - CSP: Violation report should include column number
https://bugs.webkit.org/show_bug.cgi?id=154418
<rdar://problem/24729525>

Reviewed by Brent Fulgham.

Source/WebCore:

Include column-number in the Content Security Policy violation report for the column number
in the source script where the violation occurred (for a script violation) as per section
Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

When a CSP report is created for a script violation the source file and line number of the
source code line where the violation occurred are included in the report. We now include
the column number in the source file where the violation occurred so as to help narrow
down the operation that triggered the violation in a complicated source code line.

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation):

LayoutTests:

Update expected results to include source file column information where the violation occurred.

http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt:

2:26 AM Changeset in webkit [197083] by Carlos Garcia Campos

24 edits
1 move
2 adds in releases/WebKitGTK/webkit-2.12

Merge r196876 - CSP: Violation report should include HTTP status code and effective-directive of protected resource
https://bugs.webkit.org/show_bug.cgi?id=154288
<rdar://problem/24674982>
And
https://bugs.webkit.org/show_bug.cgi?id=115707
<rdar://problem/24383128>

Reviewed by Brent Fulgham.

Source/WebCore:

Include status-code and effective-directive in the Content Security Policy violation report for
the HTTP status code of the protected resource and name of the policy directive that was violated,
respectively, as per section Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

Test: http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https.html

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation): Add key status-code to the report with value
equal to the HTTP response code for the document or 0 depending on whether the document was
delivered over HTTP or not. Additionally, remove ENABLE(CSP_NEXT)-guard/experimentalFeaturesEnabled()-condition
around code to include the effective-directive property in the report.

LayoutTests:

Add new test http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https.html to ensure
that the CSP report property status-code is 0 when the protected document is delivered over HTTPS. Fix a
correctness issue in the result for test http/tests/security/contentSecurityPolicy/report-blocked-file-uri.html
and update the expected results for the following tests now that the CSP violation report includes properties
status-code and effective-directive:

http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.php
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.php
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.php

The rest of the changes to the expected results are cosmetic and reflect the difference in wording for inline
script violations between WebKit and Blink. We will consider adopting wording similar to Blink in
<https://bugs.webkit.org/show_bug.cgi?id=153242>.

TestExpectations: Remove entries for tests that now pass. Add test http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.php.
http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive-expected.txt:
http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.html. The report-uri

directive is only honored when defined in a policy delivered via an HTTP header. We convert this
HTML file to a PHP script to be able to deliver a Content-Security-Policy HTTP header.

http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt: Update expected result now

that the report includes properties status-code and effective-directive.

http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-only-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt: Update expected result now

that the report includes properties status-code and effective-directive.

http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt: Update expected result now

that the report includes properties status-code and effective-directive.

http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https.html: Added.
http/tests/security/contentSecurityPolicy/report-uri-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-uri-from-child-frame.html: Fix ill-formed markup; substitute </iframe> for </script>.
http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-uri-scheme-relative-expected.txt: Ditto.

2:25 AM Changeset in webkit [197082] by Carlos Garcia Campos

22 edits
16 moves
3 adds
2 deletes in releases/WebKitGTK/webkit-2.12

Merge r196875 - CSP: report-url directive should be ignored when contained in a policy defined via a meta element
https://bugs.webkit.org/show_bug.cgi?id=154307
<rdar://problem/24684817>

Reviewed by Brent Fulgham.

Source/WebCore:

The Content Security Policy report-uri directive should only be honored when defined via an HTTP header
as per section report-uri of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

Currently we honor the report-uri directive when enforcing or monitoring a policy defined either via
an HTML meta element or an HTTP header. Instead we should only honor this directive when defined
via an HTTP header and log a message to the Web Inspector console to explain that the directive
was ignored as suggested in <https://www.w3.org/TR/2015/CR-CSP2-20150721/#delivery-html-meta-element>.

Test: http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored.html

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::parse): Modified to ignore the directive report-uri when
the Content Security Policy came from an HTML meta element.

LayoutTests:

Add new test http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored.html and rename and modify
existing tests to make them PHP scripts that emit a Content Security Policy HTTP header.

In addition, remove file http/tests/security/contentSecurityPolicy/resources/generate-csp-report.html that
is no longer meaningful now that we do not honor the report-uri directive defined in a policy via a meta
element. Moreover, we have not made use of this file since <http://trac.webkit.org/changeset/176413>.

TestExpectations: Update entries for renames.
http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
http/tests/security/contentSecurityPolicy/report-and-enforce.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-and-enforce.html.
http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-data-uri.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-data-uri.html.
http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-file-uri.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-file-uri.html.
http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin.html.
http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-uri.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-uri.html.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt:
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt:
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.html.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt:
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.html.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.html.
http/tests/security/contentSecurityPolicy/report-only-expected.txt:
http/tests/security/contentSecurityPolicy/report-only.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-only.html.
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt:
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.html.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt:
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt:
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.html.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.html.
http/tests/security/contentSecurityPolicy/report-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript.html.
http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-javascript.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-uri-from-javascript.html.
http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored.html: Added.
http/tests/security/contentSecurityPolicy/report-uri-scheme-relative-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-scheme-relative.html: Removed.
http/tests/security/contentSecurityPolicy/report-uri-scheme-relative.php: Added.
http/tests/security/contentSecurityPolicy/report-uri.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-uri.html.
http/tests/security/contentSecurityPolicy/resources/generate-csp-report.html: Removed. For completeness, we have

not made use of this file since <http://trac.webkit.org/changeset/176413>.

http/tests/security/contentSecurityPolicy/resources/generate-csp-report.php:
http/tests/security/contentSecurityPolicy/user-style-sheet-font-crasher.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/user-style-sheet-font-crasher.html.
platform/wk2/TestExpectations: Update entries for renames.

2:23 AM Changeset in webkit [197081] by Carlos Garcia Campos

7 edits
2 moves
6 adds
6 deletes in releases/WebKitGTK/webkit-2.12

Merge r196874 - CSP: sandbox directive should be ignored when contained in a policy defined via a meta element
https://bugs.webkit.org/show_bug.cgi?id=154299
<rdar://problem/24680433>

Reviewed by Brent Fulgham.

Source/WebCore:

The Content Security Policy sandbox directive should only be honored when enforcing a policy
defined via an HTTP header as per section sandbox of the Content Security Policy 2.0 spec.,
<https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

Currently we honor the sandbox directive when enforcing a policy defined either via an HTML
meta element or an HTTP header. Instead we should only honor this directive when defined
via an HTTP header and log a message to the Web Inspector console to explain that the directive
was ignored as suggested in <https://www.w3.org/TR/2015/CR-CSP2-20150721/#delivery-html-meta-element>.

Tests: http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header2.php

http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe.php
http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header.php
http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored.html

dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Substitute ContentSecurityPolicy::processHTTPEquiv() for
ContentSecurityPolicy::didReceiveHeader() as the latter was made private.

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::copyStateFrom): Updated as needed based on ContentSecurityPolicy::didReceiveHeader() change below.
(WebCore::ContentSecurityPolicy::didReceiveHeaders): Ditto.
(WebCore::ContentSecurityPolicy::didReceiveHeader): Modified to take argument of type ContentSecurityPolicy::PolicyFrom
and pass it through to ContentSecurityPolicyDirectiveList::create().
(WebCore::ContentSecurityPolicy::reportInvalidDirectiveInHTTPEquivMeta): Logs a message to the Web Inspector console
that the specified directive was ignored because it was delivered via an HTML meta element.

page/csp/ContentSecurityPolicy.h: Made member function ContentSecurityPolicy::didReceiveHeader() private. Defined

enum class PolicyFrom to represent the source of the Content Security Policy: HTTP equiv meta element, HTTP header, or
inherited from another ContentSecurityPolicy object (this value is only used by ContentSecurityPolicy::copyStateFrom()).
(WebCore::ContentSecurityPolicy::processHTTPEquiv): Added; turns around and calls ContentSecurityPolicy::didReceiveHeader().
The name of this function better describes its purpose - to handle the processing of a Content Security Policy
delivered via <meta http-equiv="Content-Security-Policy" content="...">.

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::create): Modified to take argument of type ContentSecurityPolicy::PolicyFrom
as pass it through to ContentSecurityPolicyDirectiveList::parse().
(WebCore::ContentSecurityPolicyDirectiveList::parse): Modified to ignore the directive sandbox when the Content Security
Policy came from an HTML meta element.

page/csp/ContentSecurityPolicyDirectiveList.h:

LayoutTests:

Add test http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored.html to ensure that we ignore
the sandbox directive when delivered via an HTML meta element and log a message to the Web Inspector console.

Remove tests http/tests/security/contentSecurityPolicy/sandbox-{allow-scripts-subframe, empty, empty-subframe}.html
that are no longer meaningful now that we ignore the sandbox directive when delivered via an HTML meta element and
create analogous tests for when the sandbox directive is delivered via an HTTP header.

http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header2-expected.txt: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-expected.txt.
http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header2.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts.html.

http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-subframe-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-subframe.html: Removed.

This test is no longer meaningful now that we ignore the sandbox directive when delivered via an HTML meta element.
An analogous test for when the directive is delivered via an HTTP header is http/tests/security/contentSecurityPolicysandbox-allow-scripts-in-http-header.html.

http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe-expected.txt: Added.
http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe.php: Added. Derived from test http/tests/security/contentSecurityPolicy/sandbox-empty-subframe.html.

http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-expected.txt: Added.
http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header.php: Added. Derived from test http/tests/security/contentSecurityPolicy/sandbox-empty.html.

http/tests/security/contentSecurityPolicy/sandbox-empty-subframe-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/sandbox-empty-subframe.html: Removed.

This test is no longer meaningful now that we ignore the sandbox directive when delivered via an HTML meta element.
The analogous test for when the directive is delivered via an HTTP header is http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe.php.

http/tests/security/contentSecurityPolicy/sandbox-empty-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/sandbox-empty.html: Removed.

http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored-expected.txt: Added.
http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored.html: Added.

2:04 AM Changeset in webkit [197080] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r196869 - Web Inspector: Opacity slider thumb sometimes goes past the bar in Visual Styles sidebar
https://bugs.webkit.org/show_bug.cgi?id=154497

Patch by Devin Rousso <Devin Rousso> on 2016-02-20
Reviewed by Timothy Hatcher.

Since WebInspector.Slider uses CSS transforms to move the slider knob
along the track, if the width of the track changes then the position
of the knob would stay the same since it was translated instead of
adjusting its position relative to the new width.

UserInterface/Views/Slider.js:

(WebInspector.Slider.prototype.recalculateKnobX):
Resets the maxX value to 0 to ensure that a new maxX is calculated with
the current width.

UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.js:

(WebInspector.VisualStyleCommaSeparatedKeywordEditor.prototype.set specifiedWidth): Deleted.
(WebInspector.VisualStyleCommaSeparatedKeywordEditor.prototype.recalculateWidth):

UserInterface/Views/VisualStyleDetailsPanel.js:

(WebInspector.VisualStyleDetailsPanel.prototype.widthDidChange):
(WebInspector.VisualStyleDetailsPanel.prototype._updateProperties):
(WebInspector.VisualStyleDetailsPanel.prototype._populateDisplaySection):

UserInterface/Views/VisualStyleUnitSlider.js:

(WebInspector.VisualStyleUnitSlider.prototype.recalculateWidth):

2:02 AM Changeset in webkit [197079] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r196867 - Web Inspector: Visual Styles: Modifying background expands Font section
https://bugs.webkit.org/show_bug.cgi?id=154491
<rdar://problem/24755440>

Patch by Devin Rousso <Devin Rousso> on 2016-02-20
Reviewed by Timothy Hatcher.

When the user selects a new style, the Visual sidebar examines the property
editors in each subsection to see if any have a value and expands/collapses
the subsection accordingly. This issue was happening because that logic was
also being triggered when the user didn't select a new style, which is
controlled by DOMNodeStyles and the significantChange value in refresh().

UserInterface/Base/Utilities.js:

(String.prototype.toCamelCase):
Added utility function to transform a string into a camel-cased version.

UserInterface/Models/DOMNodeStyles.js:

(WebInspector.DOMNodeStyles.prototype.refresh.fetchedComputedStyle):
Dropped unused variable and added checks to make sure doubly-matching styles
don't count as a significant change and cause refreshes of the styles sidebar.

UserInterface/Views/VisualStyleDetailsPanel.js:

(WebInspector.VisualStyleDetailsPanel.prototype._updateSections):
If this function has an event, meaning it was triggered by a newly selected
selector in the selector section, loop through each subsection and perform
the logic described above, but instead only to open sections.

(WebInspector.VisualStyleDetailsPanel.prototype._generateSection.replaceDashWithCapital): Deleted.
(WebInspector.VisualStyleDetailsPanel.prototype._updateProperties):
Removed logic that was already being called by _sectionModified().

2:00 AM Changeset in webkit [197078] by Carlos Garcia Campos

7 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r196864 - Resolve style iteratively
https://bugs.webkit.org/show_bug.cgi?id=154355

Reviewed by Andreas Kling.

Instead of a set of recursive functions use ComposedTreeIterator for traversing the DOM
tree in composed tree order.

This, along with maintaining explicit parent stack makes style resolve code more tractable
for future work.

It also makes the ComposedTreeIterator the definite authority for the shape of the composed tree
instead of duplicating it as a set of recursive style resolve functions. This eliminates
a significant source of bugs and confusion.

The render tree building code path remains recursive for now.

css/StyleInvalidationAnalysis.cpp:

(WebCore::StyleInvalidationAnalysis::invalidateIfNeeded):

Invalidate the host element instead of the shadow root. This reduces need for special handling for shadow roots.

dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::initializeContextStack):
(WebCore::ComposedTreeIterator::dropAssertions):

Add support for dropping DOM mutation assertions.

(WebCore::ComposedTreeIterator::traverseShadowRoot):

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::context):
(WebCore::ComposedTreeIterator::current):

dom/PseudoElement.h:
style/StyleTreeResolver.cpp:

(WebCore::Style::TreeResolver::TreeResolver):
(WebCore::Style::TreeResolver::Scope::Scope):
(WebCore::Style::TreeResolver::Parent::Parent):
(WebCore::Style::TreeResolver::pushScope):
(WebCore::Style::resetStyleForNonRenderedDescendants):
(WebCore::Style::pseudoStyleCacheIsInvalid):
(WebCore::Style::TreeResolver::resolveElement):
(WebCore::Style::resolveTextNode):
(WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement):
(WebCore::Style::TreeResolver::pushParent):
(WebCore::Style::TreeResolver::popParent):
(WebCore::Style::TreeResolver::popParentsToDepth):

Maintain explicit parent stack.

(WebCore::Style::TreeResolver::resolveComposedTree):

The main loop that iterates over the composed tree and computes style for dirty elements.

(WebCore::Style::TreeResolver::resolve):
(WebCore::Style::detachRenderTree):
(WebCore::Style::TreeResolver::resolveLocally): Deleted.
(WebCore::Style::TreeResolver::resolveChildAtShadowBoundary): Deleted.
(WebCore::Style::TreeResolver::resolveShadowTree): Deleted.
(WebCore::Style::TreeResolver::resolveChildren): Deleted.
(WebCore::Style::TreeResolver::resolveSlotAssignees): Deleted.
(WebCore::Style::TreeResolver::resolveRecursively): Deleted.

Recursive functions go away.

style/StyleTreeResolver.h:

(WebCore::Style::TreeResolver::scope):
(WebCore::Style::TreeResolver::parent):

2:00 AM Changeset in webkit [197077] by Carlos Garcia Campos

7 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r196833 - ComposedTreeIterator traverses normal children for elements with empty shadow root
https://bugs.webkit.org/show_bug.cgi?id=154464

Reviewed by Ryosuke Niwa.

Source/WebCore:

Test: fast/shadow-dom/composed-tree-basic.html

dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::initializeContextStack):
(WebCore::ComposedTreeIterator::traverseShadowRoot):

If the shadow root is empty continue by skipping the real children.

(WebCore::ComposedTreeIterator::traverseNextInShadowTree):
(WebCore::composedTreeAsText):
(WebCore::ComposedTreeIterator::pushContext): Deleted.

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::context):
(WebCore::ComposedTreeIterator::current):
(WebCore::ComposedTreeIterator::traverseNext):
(WebCore::composedTreeChildren):

testing/Internals.cpp:

(WebCore::Internals::composedTreeAsText):

Testing support.

testing/Internals.h:
testing/Internals.idl:

LayoutTests:

fast/shadow-dom/composed-tree-basic-expected.txt: Added.
fast/shadow-dom/composed-tree-basic.html: Added.

1:48 AM Changeset in webkit [197076] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r196863 - Web Inspector: Text Align segmented control blinks while editing other properties in Visual Styles sidebar
https://bugs.webkit.org/show_bug.cgi?id=154487
<rdar://problem/24754703>

Patch by Devin Rousso <Devin Rousso> on 2016-02-20
Reviewed by Timothy Hatcher.

The icon list property editor blinking issue was caused by the fact that
the selected value was toggled on/off each time the value was set on the
editor. In order to prevent this, the logic for the setter value() was
modified to just match a keyword icon to the given value and select it.

UserInterface/Views/VisualStyleKeywordIconList.js:

(WebInspector.VisualStyleKeywordIconList.prototype.set value):
(WebInspector.VisualStyleKeywordIconList.prototype._handleKeywordChanged):

1:47 AM Changeset in webkit [197075] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r196857 - Web Inspector: Placeholder text in Visual Styles sidebar table row should be white
https://bugs.webkit.org/show_bug.cgi?id=154488
<rdar://problem/24754715>

Reviewed by Timothy Hatcher.

UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.css:

1:46 AM Changeset in webkit [197074] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r196855 - Web Inspector: Inherited selector rows have text too low
https://bugs.webkit.org/show_bug.cgi?id=154489
<rdar://problem/24754774>

Reviewed by Timothy Hatcher.

UserInterface/Views/VisualStyleSelectorSection.css:

(.details-section.visual-style-selector-section > .content > .selectors > .selector-list > .section-divider):

1:45 AM Changeset in webkit [197073] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI

Merge r196852 - Web Inspector: Color picker in Visual Styles sidebar should not default to zero alpha
https://bugs.webkit.org/show_bug.cgi?id=154474
<rdar://problem/24750217>

Patch by Devin Rousso <Devin Rousso> on 2016-02-19
Reviewed by Timothy Hatcher.

UserInterface/Views/InlineSwatch.js:

(WebInspector.InlineSwatch.prototype._fallbackValue):
Changed the fallback value for color from transparent to white so that
the color picker starts out with an alpha value of 1.

(WebInspector.InlineSwatch.prototype._handleContextMenuEvent):
Prevents context menu events from having an effect if there is no value
for them to modify.

1:43 AM Changeset in webkit [197072] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r196851 - Use more concrete types for parsing positions
https://bugs.webkit.org/show_bug.cgi?id=154481

Reviewed by Dean Jackson.

Use CSSPrimitiveValues for position-parsing functions where possible, to avoid
the need to downcast<> the values returned by the parsing functions.

css/CSSParser.cpp:

(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parsePositionX):
(WebCore::CSSParser::parsePositionY):
(WebCore::CSSParser::parse4ValuesFillPosition):
(WebCore::CSSParser::parse3ValuesFillPosition):
(WebCore::CSSParser::parseFillPosition):
(WebCore::CSSParser::parse2ValuesFillPosition):
(WebCore::CSSParser::parseFillProperty):
(WebCore::CSSParser::parseTransformOriginShorthand):
(WebCore::CSSParser::parseBasicShapeCircle):
(WebCore::CSSParser::parseBasicShapeEllipse):
(WebCore::CSSParser::parseDeprecatedRadialGradient):
(WebCore::CSSParser::parseRadialGradient):
(WebCore::CSSParser::parseTransformOrigin):
(WebCore::CSSParser::parsePerspectiveOrigin):

css/CSSParser.h:

1:40 AM Changeset in webkit [197071] by Carlos Garcia Campos

5 edits
3 adds in releases/WebKitGTK/webkit-2.12

Merge r196849 - JSObject::getPropertySlot - index-as-propertyname, override on prototype, & shadow
https://bugs.webkit.org/show_bug.cgi?id=154416

Reviewed by Geoff Garen.

Source/JavaScriptCore:

Here's the bug. Suppose you call JSObject::getOwnProperty and -

PropertyName contains an index,
An object on the prototype chain overrides getOwnPropertySlot, and has that index property,
The base of the access (or another object on the prototype chain) shadows that property.

JSObject::getPropertySlot is written assuming the common case is that propertyName is not an
index, and as such walks up the prototype chain looking for non-index properties before it
tries calling parseIndex.

At the point we reach an object on the prototype chain overriding getOwnPropertySlot (which
would potentially return the property) we may have already skipped over non-overriding
objects that contain the property in index storage.

runtime/JSObject.h:

(JSC::JSObject::getOwnNonIndexPropertySlot):

renamed from inlineGetOwnPropertySlot to better describe behaviour; added ASSERT guarding that this method never returns index properties - if it ever does, this is unsafe for getPropertySlot.

(JSC::JSObject::getOwnPropertySlot):

inlineGetOwnPropertySlot -> getOwnNonIndexPropertySlot.

(JSC::JSObject::getPropertySlot):

In case of object overriding getOwnPropertySlot check if propertyName is an index.

(JSC::JSObject::getNonIndexPropertySlot):

called by getPropertySlot if we encounter an object that overrides getOwnPropertySlot, in order to avoid repeated calls to parseIndex.

(JSC::JSObject::inlineGetOwnPropertySlot): Deleted.

this was renamed to getOwnNonIndexPropertySlot.

(JSC::JSObject::fastGetOwnPropertySlot): Deleted.

this was folded back in to getPropertySlot.

Source/WebCore:

testing/Internals.cpp:

(WebCore::Internals::isReadableStreamDisturbed):

fastGetOwnPropertySlot -> getOwnPropertySlot (internal method removed; test shouldn't really have been using this anyway)

LayoutTests:

js/index-property-shadows-overriden-get-own-property-slot-expected.txt: Added.
js/index-property-shadows-overriden-get-own-property-slot.html: Added.
js/script-tests/index-property-shadows-overriden-get-own-property-slot.js: Added.

(test):

added test case.

1:16 AM Changeset in webkit [197070] by Carlos Garcia Campos

11 edits in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r196873 - bmalloc: Don't use a whole page for metadata
https://bugs.webkit.org/show_bug.cgi?id=154510

Reviewed by Andreas Kling.

(1) Don't round up metadata to a page boundary. This saves 1.5% dirty
memory on iOS and 0.2% on Mac. It also enables a future patch to allocate
smaller chunks without wasting memory.

(2) Initialize metadata lazily. This saves dirty memory when the program
allocates primarily small or large objects (but not both), leaving some
metadata uninitialized.

bmalloc.xcodeproj/project.pbxproj: Medium objects are gone now.

bmalloc/BumpAllocator.h:

(bmalloc::BumpAllocator::refill): Added an ASSERT to help debug a bug
I cause while working on this patch.

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateSmallBumpRanges): Ditto.

(bmalloc::Heap::splitAndAllocate):
(bmalloc::Heap::allocateLarge): Updated for interface change.

bmalloc/LargeChunk.h: Changed the boundaryTagCount calculation to

a static_assert.

Don't round up to page boundary. (See above.)

(bmalloc::LargeChunk::LargeChunk): Moved code here from LargeChunk::init.
A constructor is a more natural / automatic way to do this initialization.

bmalloc/LargeObject.h:

(bmalloc::LargeObject::init): Deleted. Moved to LargeChunk.

bmalloc/Sizes.h: Chagned largeChunkMetadataSize to a simpler constant

because metadata size no longer varies by page size.

bmalloc/SmallChunk.h:

(bmalloc::SmallChunk::begin):
(bmalloc::SmallChunk::end):
(bmalloc::SmallChunk::lines):
(bmalloc::SmallChunk::pages): Use std::array to make begin/end
calculations easier.

(bmalloc::SmallChunk::SmallChunk): Treat our metadata like a series
of allocated objects. We used to avoid trampling our metadata by
starting object memory at the next page. Now we share the first page
between metadata and objects, and we account for metadata explicitly.

bmalloc/SuperChunk.h:

(bmalloc::SuperChunk::SuperChunk):
(bmalloc::SuperChunk::smallChunk):
(bmalloc::SuperChunk::largeChunk):
(bmalloc::SuperChunk::create): Deleted. Don't eagerly run the SmallChunk
and LargeChunk constructors. We'll run them lazily as needed.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::VMHeap):
(bmalloc::VMHeap::allocateSmallChunk):
(bmalloc::VMHeap::allocateLargeChunk):
(bmalloc::VMHeap::allocateSuperChunk):
(bmalloc::VMHeap::grow): Deleted. Track small and large chunks explicitly
so we can initialize them lazily.

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateSmallPage):
(bmalloc::VMHeap::allocateLargeObject): Specify whether we're allocating
a small or large chunk since we don't allocate both at once anymore.

Fixed compilation of bmalloc with GCC 4.8 after r196873.
https://bugs.webkit.org/show_bug.cgi?id=154534

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-22
Reviewed by Mark Lam.

See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55382.

bmalloc/LargeChunk.h:
bmalloc/SmallChunk.h:

1:15 AM Changeset in webkit [197069] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12/Source

Merge r196871 - Use of inlined asm statements causes problems for -std=c99 builds.
https://bugs.webkit.org/show_bug.cgi?id=154507

Reviewed by Dan Bernstein.

Source/bmalloc:

bmalloc/BAssert.h:

Source/WTF:

WTF's Assertions.h may inadvertantly get included by other projects that are built
with -std=c99. The use of the inlined asm statements with the keyword "asm" is
not recognized when the -std compiler flag is used.

https://gcc.gnu.org/onlinedocs/gcc/Extended-Asm.html says "When writing code that
can be compiled with -ansi and the various -std options, use asm instead of
asm (see Alternate Keywords)."

So, to be a good citizen, we can change the use of "asm" in CRASH() to "asm"
so that we don't break the build of such other projects.

wtf/Assertions.h:

1:15 AM Changeset in webkit [197068] by Carlos Garcia Campos

8 edits
4 deletes in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r196847 - bmalloc: Chunk, Page, and Line don't need to be class templates
https://bugs.webkit.org/show_bug.cgi?id=154480

Reviewed by Gavin Barraclough.

We needed class templates to distinguish between small and medium,
but medium is gone now.

bmalloc.xcodeproj/project.pbxproj:
bmalloc/Chunk.h: Removed.
bmalloc/Heap.cpp:

(bmalloc::Heap::initializeLineMetadata):
(bmalloc::Heap::allocateSmallBumpRanges):

bmalloc/Heap.h:
bmalloc/Line.h: Removed.
bmalloc/Page.h: Removed.
bmalloc/Sizes.h:
bmalloc/SmallChunk.h: Replaced with Source/bmalloc/bmalloc/Chunk.h.

(bmalloc::SmallChunk::begin):
(bmalloc::SmallChunk::end):
(bmalloc::SmallChunk::lines):
(bmalloc::SmallChunk::pages):
(bmalloc::SmallChunk::get):
(bmalloc::SmallLine::get):
(bmalloc::SmallLine::begin):
(bmalloc::SmallLine::end):
(bmalloc::SmallPage::get):
(bmalloc::SmallPage::begin):
(bmalloc::SmallPage::end):
(bmalloc::Chunk::begin): Deleted.
(bmalloc::Chunk::end): Deleted.
(bmalloc::Chunk::lines): Deleted.
(bmalloc::Chunk::pages): Deleted.

bmalloc/SmallLine.h: Replaced with Source/bmalloc/bmalloc/Line.h.

(bmalloc::SmallLine::ref):
(bmalloc::SmallLine::deref):
(bmalloc::Line<Traits>::begin): Deleted.
(bmalloc::Line<Traits>::end): Deleted.
(bmalloc::Line<Traits>::ref): Deleted.
(bmalloc::Line<Traits>::deref): Deleted.

bmalloc/SmallPage.h: Replaced with Source/bmalloc/bmalloc/Page.h.

(bmalloc::SmallPage::hasFreeLines):
(bmalloc::SmallPage::setHasFreeLines):
(bmalloc::SmallPage::ref):
(bmalloc::SmallPage::deref):
(bmalloc::Page::hasFreeLines): Deleted.
(bmalloc::Page::setHasFreeLines): Deleted.
(bmalloc::Page<Traits>::ref): Deleted.
(bmalloc::Page<Traits>::deref): Deleted.

bmalloc/SmallTraits.h: Removed.

Unreviewed. Fix debug build error since r196847

Fix gcc build warning appeared as below
by removing BASSERT(refCount <= maxRefCount).
error: comparison is always true due to limited range of data type
[-Werror=type-limits]

bmalloc/SmallLine.h:

(bmalloc::SmallLine::ref): Deleted.

1:15 AM Changeset in webkit [197067] by Carlos Garcia Campos

19 edits
4 deletes in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r196845 - bmalloc: Remove the concept of medium objects
https://bugs.webkit.org/show_bug.cgi?id=154436

Reviewed by Sam Weinig.

There's no need to distinguish medium objects from small: Small object
metadata works naturally for both as long as we allow an object to
span more than two small lines. (We already allow an object to span
more than one small line.)

This change reduces memory use because it eliminates the 1kB line size,
so we don't have to hold down 1kB lines for individual 264+ byte objects.

1kB lines were always a bit of a compromise. The main point of bump
allocation is to take advantage of cache lines. Cache lines are usually
64 bytes, so line sizes above 256 bytes are a bit of a stretch.

This change speeds up small object benchmarks because it eliminates the
branch to detect medium objects in deallocation log processing.

This change reduces virtual memory use from worst cast 4X to worst case
2X because the medium chunk is gone. iOS cares about virtual memory use
and terminates apps above ~1GB, so this change gives us more breathing room.

This change slows down medium benchmarks a bit because we end up doing
more work to recycle fragmented medium objects. Overall, the tradeoff
seems justified, since we have a net speedup and a memory use savings.

bmalloc.xcodeproj/project.pbxproj: Removed all the medium files. We

can simplify even further in a follow-up patch, removing the base class
templates for Chunk, Page, and Line as well.

bmalloc/Allocator.cpp:

(bmalloc::Allocator::Allocator):
(bmalloc::Allocator::allocate):
(bmalloc::Allocator::reallocate):
(bmalloc::Allocator::scavenge):
(bmalloc::Allocator::refillAllocatorSlowCase):
(bmalloc::Allocator::refillAllocator):
(bmalloc::Allocator::allocateSlowCase): Medium is gone. Small max is the
new medium max.

bmalloc/Allocator.h:

(bmalloc::Allocator::allocateFastCase): Ditto.

bmalloc/BumpAllocator.h:

(bmalloc::BumpAllocator::validate):
(bmalloc::BumpAllocator::allocate): No more medium.

bmalloc/Chunk.h: No more medium.

bmalloc/Deallocator.cpp:

(bmalloc::Deallocator::processObjectLog): No check for medium. This is
a speedup.

(bmalloc::Deallocator::deallocateSlowCase): No more medium.

bmalloc/Deallocator.h:

(bmalloc::Deallocator::deallocateFastCase): Ditto.

bmalloc/Heap.cpp:

(bmalloc::Heap::initializeLineMetadata): The algorithm here changed from
iterating each line to iterating each object. This helps us accomodate
objects that might span more than two lines -- i.e., all objects between
(512 bytes, 1024 bytes].

(bmalloc::Heap::scavenge):
(bmalloc::Heap::scavengeSmallPages):
(bmalloc::Heap::scavengeLargeObjects): Medium is gone.

(bmalloc::Heap::allocateSmallBumpRanges): Allow for lines that allocate
zero objects. This happens when an object spans more than two lines --
the middle lines allocate zero objects.

Also set the "has free lines" bit to false if we consume the last free
line. This needs to be a bit now because not all pages agree on their
maximum refcount anymore, so we need an explicit signal for the transition
from maximum to maximum - 1.

(bmalloc::Heap::allocateSmallPage): This code didn't change; I just removed
the medium code.

(bmalloc::Heap::deallocateSmallLine): Changed the algorithm to check
hasFreeLines. See allocateSmallBumpRanges.

(bmalloc::Heap::scavengeMediumPages): Deleted.
(bmalloc::Heap::allocateMediumBumpRanges): Deleted.
(bmalloc::Heap::allocateMediumPage): Deleted.
(bmalloc::Heap::deallocateMediumLine): Deleted.

bmalloc/Heap.h:

(bmalloc::Heap::derefMediumLine): Deleted.

bmalloc/LargeChunk.h:

(bmalloc::LargeChunk::get):
(bmalloc::LargeChunk::endTag):

bmalloc/Line.h: No more medium.

bmalloc/MediumChunk.h: Removed.
bmalloc/MediumLine.h: Removed.
bmalloc/MediumPage.h: Removed.
bmalloc/MediumTraits.h: Removed.

bmalloc/ObjectType.cpp:

(bmalloc::objectType):

bmalloc/ObjectType.h:

(bmalloc::isSmall):
(bmalloc::isXLarge):
(bmalloc::isSmallOrMedium): Deleted.
(bmalloc::isMedium): Deleted. No more medium.

bmalloc/Page.h:

(bmalloc::Page::sizeClass):
(bmalloc::Page::setSizeClass):
(bmalloc::Page::hasFreeLines):
(bmalloc::Page::setHasFreeLines): Add the free lines bit. You get better
codegen if you make it the low bit, since ref / deref can then add / sub

So do that.

bmalloc/Sizes.h:

(bmalloc::Sizes::sizeClass): Expand the small size class to include the
medium size class.

bmalloc/SuperChunk.h:

(bmalloc::SuperChunk::SuperChunk):
(bmalloc::SuperChunk::smallChunk):
(bmalloc::SuperChunk::largeChunk):
(bmalloc::SuperChunk::mediumChunk): Deleted. No more medium.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::grow):

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateSmallPage): Set the has free lines bit before
returning a Page to the Heap since this is the correct default state
when we first allocate a page.

(bmalloc::VMHeap::allocateMediumPage): Deleted.
(bmalloc::VMHeap::deallocateMediumPage): Deleted.

1:14 AM Changeset in webkit [197066] by Carlos Garcia Campos

13 edits
1 move in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r196840 - bmalloc: Unify VMHeap and Heap LargeObjects free lists to reduce fragmentation
https://bugs.webkit.org/show_bug.cgi?id=154192

Reviewed by Geoffrey Garen.

Change the operation of Heap and VMHeap LargeObject free lists.
Renamed Owner to VMState to track the state of each LargeObject.

Physical - The pages have been allocated.
Virtual - The pages have not been allocated.
Mixed - The object contains a mixture of Physical and Virtual pages.

In both Heap::allocateLarge(), we now allocate physical pages if the LargeObject we
pull from the free list has any Virtual pages before we possilby split the
object. When we merge objects, the result might be made up of Mixed page allocations.
When allocating a Mixed LargeObject, we need to allocate memory for them as well.
The scavenger deallocates both Physical and Mixed LargeObjects, placing them back into
the VMHeap's free list.

When we allocate or deallocate Mixed LargeObjects, there are pages that within these
objects that will be redundantly modified. It would require additional metadata to
eliminate this redundancy.

bmalloc.xcodeproj/project.pbxproj:
bmalloc/BoundaryTag.h:

(bmalloc::BoundaryTag::vmState): New helper.
(bmalloc::BoundaryTag::setVMState): New helper.
(bmalloc::BoundaryTag::owner): Deleted.
(bmalloc::BoundaryTag::setOwner): Deleted.

bmalloc/Heap.h:

(bmalloc::Heap::splitAndAllocate): New helpers.

bmalloc/LargeObject.h:

(bmalloc::LargeObject::vmState): New helper.
(bmalloc::LargeObject::setVMState): New helper.

bmalloc/Heap.cpp:

(bmalloc::Heap::splitAndAllocate): New helpers.
(bmalloc::Heap::allocateLarge):
(bmalloc::Heap::deallocatePhysicalPages): Refactored from VMHeap::deallocateLargeObjectMemory.

bmalloc/FreeList.cpp:

(bmalloc::FreeList::takeGreedy):
(bmalloc::FreeList::take):
(bmalloc::FreeList::removeInvalidAndDuplicateEntries):

bmalloc/FreeList.h:

(bmalloc::FreeList::FreeList):
(bmalloc::FreeList::push):

bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):
(bmalloc::Heap::scavengeLargeObjects):

bmalloc/LargeObject.h:

(bmalloc::LargeObject::isValidAndFree):
(bmalloc::LargeObject::validateSelf):

bmalloc/SegregatedFreeList.cpp:

(bmalloc::SegregatedFreeList::SegregatedFreeList): Changed to initialize our required Physical state.

bmalloc/SegregatedFreeList.h:

(bmalloc::SegregatedFreeList::SegregatedFreeList):
(bmalloc::SegregatedFreeList::insert):
(bmalloc::SegregatedFreeList::takeGreedy):
(bmalloc::SegregatedFreeList::take):
Replaced Owner parameters and checks with VMState::HasPhysical.

bmalloc/LargeObject.h:

(bmalloc::LargeObject::prevCanMerge): Removed owner from tests.
(bmalloc::LargeObject::nextCanMerge): Removed owner from tests.
(bmalloc::LargeObject::merge): Removed owner from tests. Updated to merge VMStates andset the
VMState after the merge.

bmalloc/LargeObject.h:

(bmalloc::LargeObject::owner): Deleted.
(bmalloc::LargeObject::setOwner): Deleted.

bmalloc/Owner.h: Removed.

bmalloc/VMAllocate.h:

(bmalloc::vmAllocatePhysicalPagesSloppy): Changed to round begin down to eliminate the left to right
allocation constraint.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::grow): Large space managed like small or medium as a vector of LargeChunks.
(bmalloc::VMHeap::VMHeap): Changed to initialize our required Physical state.

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateLargeObject): These no longer allocate memory.
(bmalloc::VMHeap::deallocateLargeObject): Removed setOwner. Now we set the VMState after any merges.

bmalloc/VMState.h: Copied from Source/bmalloc/bmalloc/Owner.h.

(bmalloc::VMState::VMState):
(bmalloc::VMState::hasPhysical):
(bmalloc::VMState::hasVirtual):
(bmalloc::VMState::merge):
(bmalloc::VMState::operator ==):
(bmalloc::VMState::operator unsigned):
New class with various helpers.

12:37 AM Changeset in webkit [197065] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r196813 - Blocked plug-in placeholder is sometimes not shown.
https://bugs.webkit.org/show_bug.cgi?id=154434
<rdar://problem/22584973>

Reviewed by Brent Fulgham.

m_isUnavailablePluginIndicatorHidden was set to false incorrectly as initial value.
It prevented RenderEmbeddedObject from issuing repaint when the plugin indicator
was set to visible (m_isUnavailablePluginIndicatorHidden <- false) the first time.
(The reason why the indicator showed up most of the time was because some renderer
triggered repaint on the view.)

Unable to test.

rendering/RenderEmbeddedObject.cpp:

(WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsHidden):
(WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Deleted.
(WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsPressed): Deleted.

rendering/RenderEmbeddedObject.h:

(WebCore::RenderEmbeddedObject::showsUnavailablePluginIndicator):

Feb 24, 2016:

11:45 PM Changeset in webkit [197064] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.10/Source

Merge r197062 - [GTK] Tearing when entering AC mode
https://bugs.webkit.org/show_bug.cgi?id=150955

Reviewed by Michael Catanzaro.

Source/WebCore:

platform/gtk/GtkUtilities.cpp:

(WebCore::widgetIsOnscreenToplevelWindow): Allow passing nullptr.

Source/WebKit2:

UIProcess/API/gtk/WebKitWebViewBase.cpp:

UIProcess/cairo/BackingStoreCairo.cpp:

11:43 PM Changeset in webkit [197063] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r196062 - [GTK] Reduce IPC traffic due to view state changes
https://bugs.webkit.org/show_bug.cgi?id=153745

Reviewed by Sergio Villar Senin.

Very often view state changes happen one after another in a very
short period of time, even in the same run loop iteration. For
example, when you switch to the web view window, the view is
focused and the active window flag changes as well. In that case
we are sending two messages to the web process and the page
updates its status according to the new flags in two steps. So, we
could group all state changes happening in the same run loop
iteration and notify about them all in the next iteration. This
also prevents unnecessary changes of state when we quickly go back
to a previous state, for example in focus follows mouse
configurations if you move the mouse outside the window and then
inside the window again quickly.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(_WebKitWebViewBasePrivate::_WebKitWebViewBasePrivate): Use
VirewState::Flags to keep the web view state instead of
boolean, and also to keep the flags that need to be updated. Use a
timer to update web view state flags.
(_WebKitWebViewBasePrivate::updateViewStateTimerFired): Call
WebPageProxy::viewStateDidChange() and reset the flags that need
to be updated.
(webkitWebViewBaseScheduleUpdateViewState): Update the flags that
need to be updated and schedule the timer if it's not active.
(toplevelWindowFocusInEvent): Use the flags and schedule an update.
(toplevelWindowFocusOutEvent): Ditto.
(toplevelWindowStateEvent): Also mark the view as hidden when minimized.
(webkitWebViewBaseSetToplevelOnScreenWindow): Connect to
window-state-event instead of deprecated visibility-notify-event.
(webkitWebViewBaseMap): Use the flags and schedule an update.
(webkitWebViewBaseUnmap): Ditto.
(webkitWebViewBaseSetFocus): Ditto.
(webkitWebViewBaseIsInWindowActive): Use the flags.
(webkitWebViewBaseIsFocused): Ditto
(webkitWebViewBaseIsVisible): Ditto.
(webkitWebViewBaseIsInWindow): Removed this since it was unused.

UIProcess/API/gtk/WebKitWebViewBasePrivate.h:

11:40 PM WebKitGTK/2.10.x edited by Carlos Garcia Campos

(diff)

11:37 PM Changeset in webkit [197062] by Carlos Garcia Campos

5 edits in trunk/Source

[GTK] Tearing when entering AC mode
https://bugs.webkit.org/show_bug.cgi?id=150955

Reviewed by Michael Catanzaro.

Source/WebCore:

platform/gtk/GtkUtilities.cpp:

(WebCore::widgetIsOnscreenToplevelWindow): Allow passing nullptr.

Source/WebKit2:

UIProcess/API/gtk/WebKitWebViewBase.cpp:

UIProcess/cairo/BackingStoreCairo.cpp:

8:59 PM Changeset in webkit [197061] by commit-queue@webkit.org

9 edits in trunk

Web Inspector: Expose Proxy target and handler internal properties to Inspector
https://bugs.webkit.org/show_bug.cgi?id=154663

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-24
Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::getInternalProperties):
Expose the ProxyObject's target and handler.

Source/WebInspectorUI:

UserInterface/Models/NativeFunctionParameters.js:
UserInterface/Views/ObjectTreePropertyTreeElement.js:

(WebInspector.ObjectTreePropertyTreeElement.prototype._functionParameterString):
Improve the native parameter list for the global Reflect object methods.
Include "enumerate" even though it is deprecated, because we implement it.

LayoutTests:

inspector/model/remote-object.html:
platform/mac/inspector/model/remote-object-expected.txt:

Test that a Proxy object includes the internal properties.

6:39 PM Changeset in webkit [197060] by Chris Dumez

46 edits in trunk/Source/WebCore

Drop [TreatReturnedNullStringAs=Null] WebKit-specific IDL attribute
https://bugs.webkit.org/show_bug.cgi?id=154659

Reviewed by Sam Weinig.

Drop [TreatReturnedNullStringAs=Null] WebKit-specific IDL attribute and
use nullable DOMString types instead:
http://heycam.github.io/webidl/#idl-nullable-type

This is the standard way of doing things. We already had support
in the bindings generator for nullable DOMString attributes so
we now just leverage this support. However, our IDL parser did
not correctly parse nullable DOMString return values for operations.
This patch fixes this.

This patch also drops [TreatNullAs=NullString] and
[TreatUndefinedAs=NullString] for writable DOMString attributes that
are now marked as nullable because they are implied.

Modules/fetch/FetchHeaders.idl:
Modules/indexeddb/IDBObjectStore.idl:
Modules/mediasource/DOMURLMediaSource.idl:
Modules/mediastream/DOMURLMediaStream.idl:
Modules/websockets/WebSocket.idl:
bindings/scripts/CodeGeneratorJS.pm:

(NativeToJSValue): Deleted.

bindings/scripts/IDLAttributes.txt:
bindings/scripts/IDLParser.pm:

(parseAttributeOrOperationRest):
(parseOperationOrIterator):
(parseSpecialOperation):

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:

(webkit_dom_test_obj_nullable_string_method):
(webkit_dom_test_obj_nullable_string_special_method):
(webkit_dom_test_obj_conditional_method3): Deleted.
(webkit_dom_test_obj_convert1): Deleted.

bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::JSTestObj::getOwnPropertySlot):
(WebCore::JSTestObj::getOwnPropertySlotByIndex):
(WebCore::JSTestObj::getOwnPropertyNames):
(WebCore::jsTestObjPrototypeFunctionNullableStringMethod):
(WebCore::jsTestObjConstructorFunctionNullableStringStaticMethod):
(WebCore::jsTestObjPrototypeFunctionNullableStringSpecialMethod):
(WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence): Deleted.
(WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence2): Deleted.

bindings/scripts/test/JS/JSTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:

(-[DOMTestObj nullableStringMethod]):
(-[DOMTestObj nullableStringStaticMethod]):
(-[DOMTestObj nullableStringSpecialMethod:]):
(-[DOMTestObj overloadedMethod1:]): Deleted.
(-[DOMTestObj getSVGDocument]): Deleted.

bindings/scripts/test/TestObj.idl:
css/CSSCharsetRule.idl:
css/CSSImportRule.idl:
css/CSSKeyframesRule.idl:
css/CSSPageRule.idl:
css/CSSRule.idl:
css/CSSStyleDeclaration.idl:
css/CSSStyleRule.idl:
css/CSSValue.idl:
css/MediaList.idl:
css/StyleSheet.idl:
dom/Attr.idl:
dom/CharacterData.idl:
dom/DOMStringList.idl:
dom/Document.idl:
dom/DocumentType.idl:
dom/Element.idl:
dom/Entity.idl:
dom/MutationRecord.idl:
dom/Node.idl:
dom/ProcessingInstruction.idl:
html/DOMSettableTokenList.idl:
html/DOMTokenList.idl:
html/DOMURL.idl:
html/canvas/WebGLDebugShaders.idl:
html/canvas/WebGLRenderingContextBase.idl:
page/DOMWindow.idl:
storage/Storage.idl:
storage/StorageEvent.idl:
xml/XMLHttpRequest.idl:
xml/XPathNSResolver.idl:

6:37 PM WebKitIDL edited by Chris Dumez

(diff)

5:28 PM Changeset in webkit [197059] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Visual Styles sidebar should support multiple animations
https://bugs.webkit.org/show_bug.cgi?id=154546
<rdar://problem/24773861>

Patch by Devin Rousso <Devin Rousso> on 2016-02-24
Reviewed by Timothy Hatcher.

UserInterface/Views/VisualStyleDetailsPanel.js:

(WebInspector.VisualStyleDetailsPanel.prototype._populateTransitionSection):
Set additional flags on the optional properties of transition to ensure
that the initial value of a new row is not considered invalid.

(WebInspector.VisualStyleDetailsPanel.prototype._populateAnimationSection):
Added a comma-separated keyword list to provide support for multiple
animations per rule.

5:11 PM Changeset in webkit [197058] by dino@apple.com

28 edits
11 adds in trunk

[web-animations] Add AnimationTimeline, DocumentTimeline and add extensions to Document interface
https://bugs.webkit.org/show_bug.cgi?id=151688

Patch by Nikos Andronikos <nikos.andronikos-webkit@cisra.canon.com.au> on 2016-02-24
Reviewed by Dean Jackson.

Enables the WEB_ANIMATIONS compiler switch.

Source/cmake/OptionsWin.cmake:

Source/JavaScriptCore:

Enables the WEB_ANIMATIONS compiler switch.

Configurations/FeatureDefines.xcconfig:

Source/WebCore:

Adds DocumentTimeline interface and class implementation
Implements the DocumentAnimation extension to the Document Interface that contains a default DocumentTimeline
Add AnimationTimeline interface stub (i.e. without getAnimations and currentTime)
Adds AnimationTimeline class implementation for AnimationTimeline interface stub
Adds Javascript bindings for the above classes and interfaces
Enables the WEB_ANIMATIONS compiler switch

No tests yet. Tests will be added as class functionality is added incrementally.

CMakeLists.txt:
Configurations/FeatureDefines.xcconfig:
DerivedSources.make:
PlatformGTK.cmake:
WebCore.vcxproj/WebCore.vcxproj:
WebCore.vcxproj/WebCore.vcxproj.filters:
WebCore.vcxproj/WebCoreIncludeCommon.props:
WebCore.vcxproj/copyForwardingHeaders.cmd:
WebCore.xcodeproj/project.pbxproj:
animation/AnimationTimeline.cpp: Added.

(WebCore::AnimationTimeline::AnimationTimeline):
(WebCore::AnimationTimeline::~AnimationTimeline):
(WebCore::AnimationTimeline::destroy):

animation/AnimationTimeline.h: Added.

(WebCore::AnimationTimeline::deref):
(WebCore::AnimationTimeline::isDocumentTimeline):
(WebCore::AnimationTimeline::classType):

animation/AnimationTimeline.idl: Added.
animation/DocumentAnimation.cpp: Added.

(WebCore::DocumentAnimation::DocumentAnimation):
(WebCore::DocumentAnimation::~DocumentAnimation):
(WebCore::DocumentAnimation::timeline):
(WebCore::DocumentAnimation::supplementName):
(WebCore::DocumentAnimation::from):

animation/DocumentAnimation.h: Added.
animation/DocumentAnimation.idl: Added.
animation/DocumentTimeline.cpp: Added.

(WebCore::DocumentTimeline::create):
(WebCore::DocumentTimeline::DocumentTimeline):
(WebCore::DocumentTimeline::~DocumentTimeline):

animation/DocumentTimeline.h: Added.
animation/DocumentTimeline.idl: Added.
bindings/js/JSAnimationTimelineCustom.cpp: Added.

(WebCore::toJS):

bindings/js/JSBindingsAllInOne.cpp:
bindings/scripts/CodeGeneratorGObject.pm:
dom/Document.h:

Source/WebKit/mac:

Enables the WEB_ANIMATIONS compiler switch.

Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

Enables the WEB_ANIMATIONS compiler switch.

Configurations/FeatureDefines.xcconfig:

Source/WTF:

Enables the WEB_ANIMATIONS compiler switch.

wtf/FeatureDefines.h:

Tools:

Enables the WEB_ANIMATIONS compiler switch by default.

Scripts/webkitperl/FeatureList.pm:

WebKitLibraries:

Enables the WEB_ANIMATIONS compiler switch.

win/tools/vsprops/FeatureDefines.props:
win/tools/vsprops/FeatureDefinesCairo.props:

4:53 PM WebKitIDL edited by Chris Dumez

Drop TreatReturnedNullStringAs=False as this is NOT supported (diff)

4:23 PM Changeset in webkit [197057] by beidson@apple.com

5 edits in trunk/Source/WebCore

Modern IDB: Some w3c objectstore tests crash under GuardMalloc.
https://bugs.webkit.org/show_bug.cgi?id=154460

Reviewed by Alex Christensen.

No new tests (Covered by existing tests).

Modules/indexeddb/server/UniqueIDBDatabase.cpp:

if there are still any connections pending close.

transaction completing, and a connection finished its close process, that the UniqueIDBDatabase is
now ready to be deleted.

Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:

(WebCore::IDBServer::UniqueIDBDatabaseConnection::abortTransactionWithoutCallback):

Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:

Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:

(WebCore::IDBServer::UniqueIDBDatabaseTransaction::abortWithoutCallback):

3:47 PM Changeset in webkit [197056] by commit-queue@webkit.org

8 edits in trunk

[cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
https://bugs.webkit.org/show_bug.cgi?id=154651

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-24
Reviewed by Alex Christensen.

Source/cmake/WebKitMacros.cmake:

Source/JavaScriptCore:

CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

Source/WebCore:

No new tests needed.

CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

Source/WTF:

CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

3:37 PM Changeset in webkit [197055] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

Use more references in FocusNavigationScope
https://bugs.webkit.org/show_bug.cgi?id=154637

Reviewed by Chris Dumez.

Use references in various functions of FocusNavigationScope as well as m_treeScope.

page/FocusController.cpp:

(WebCore::FocusNavigationScope::FocusNavigationScope): Takes TreeScope& instead of TreeScope*.
(WebCore::FocusNavigationScope::rootNode): Returns ContainerNode& instead of ContainerNode*.
(WebCore::FocusNavigationScope::owner):
(WebCore::FocusNavigationScope::scopeOf): Takes Node& instead of Node*. Renamed from focusNavigationScopeOf.
(WebCore::FocusNavigationScope::scopeOwnedByShadowHost): Ditto. Renamed from focusNavigationScopeOwnedByShadowHost.
(WebCore::FocusNavigationScope::scopeOwnedByIFrame): Ditto. Renamed from focusNavigationScopeOwnedByIFrame.
(WebCore::FocusController::findFocusableElementDescendingDownIntoFrameDocument):
(WebCore::FocusController::advanceFocusInDocumentOrder):
(WebCore::FocusController::findFocusableElementAcrossFocusScope): Define currentScope inside the loop now that
the copy constructor of FocusNavigationScope no longer exists (since m_treeScope is a reference).
(WebCore::FocusController::findFocusableElementRecursively):
(WebCore::nextElementWithGreaterTabIndex):
(WebCore::FocusController::nextFocusableElement):
(WebCore::FocusController::previousFocusableElement):

3:19 PM Changeset in webkit [197054] by barraclough@apple.com

7 edits in trunk/Source/WebKit2

Add WKPreference for HiddenPageDOMTimerThrottlingAutoIncreases
https://bugs.webkit.org/show_bug.cgi?id=154655

Reviewed by Geoff Garen.

Just plumbing WebCore.settings.setHiddenPageDOMTimerThrottlingAutoIncreases through as
WKPreferencesSetHiddenPageDOMTimerThrottlingAutoIncreases.

Shared/WebPreferencesDefinitions.h:
UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetHiddenPageDOMTimerThrottlingAutoIncreases):
(WKPreferencesGetHiddenPageDOMTimerThrottlingAutoIncreases):

UIProcess/API/C/WKPreferencesRefPrivate.h:
UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences _hiddenPageDOMTimerThrottlingAutoIncreases]):
(-[WKPreferences _setHiddenPageDOMTimerThrottlingAutoIncreases:]):

UIProcess/API/Cocoa/WKPreferencesPrivate.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

2:23 PM Changeset in webkit [197053] by adam.bergkvist@ericsson.com

5 edits
8 adds in trunk/Source/WebCore

WebRTC: Add MediaEndpoint interface (WebRTC backend abstraction)
https://bugs.webkit.org/show_bug.cgi?id=150165

Reviewed by Eric Carlson.

Add the MediaEndpoint interface along with its companion objects.

MediaEndpoint interface: A WebRTC platform abstraction that is used to
configure how the the WebRTC backend sends and receives. It also abstracts
ICE functionality such as generating local candidates and doing
checking on remote candidates. The RTCPeerConnection API, and other API
objects such as RTCRtpSender/Receiver, live above MediaEndpoint.

MediaEndpointConfiguration: A settings object used to configure a
MediaEndpoint with, for example, ICE helper servers and other polices.
A MediaEndpointConfiguration is used to initialize a MediaEndpoint, but
can also be used to update settings.

MediaEndpointSessionConfiguration: An object that describes how the
MediaEndpoint should send and receive. Contains PeerMediaDescription,
MediaPayload and IceCandidate objects.

Tests: The MediaEndpoint platform interface has no implementations yet.

CMakeLists.txt:
Modules/mediastream/MediaEndpointPeerConnection.cpp:

(WebCore::MediaEndpointPeerConnection::gotDtlsFingerprint):
(WebCore::MediaEndpointPeerConnection::gotIceCandidate):
(WebCore::MediaEndpointPeerConnection::doneGatheringCandidates):
(WebCore::MediaEndpointPeerConnection::gotRemoteSource):

Modules/mediastream/MediaEndpointPeerConnection.h:
WebCore.xcodeproj/project.pbxproj:
platform/mediastream/IceCandidate.h: Added.

(WebCore::IceCandidate::create):
(WebCore::IceCandidate::~IceCandidate):
(WebCore::IceCandidate::type):
(WebCore::IceCandidate::setType):
(WebCore::IceCandidate::foundation):
(WebCore::IceCandidate::setFoundation):
(WebCore::IceCandidate::componentId):
(WebCore::IceCandidate::setComponentId):
(WebCore::IceCandidate::transport):
(WebCore::IceCandidate::setTransport):
(WebCore::IceCandidate::priority):
(WebCore::IceCandidate::setPriority):
(WebCore::IceCandidate::address):
(WebCore::IceCandidate::setAddress):
(WebCore::IceCandidate::port):
(WebCore::IceCandidate::setPort):
(WebCore::IceCandidate::tcpType):
(WebCore::IceCandidate::setTcpType):
(WebCore::IceCandidate::relatedAddress):
(WebCore::IceCandidate::setRelatedAddress):
(WebCore::IceCandidate::relatedPort):
(WebCore::IceCandidate::setRelatedPort):
(WebCore::IceCandidate::clone):
(WebCore::IceCandidate::IceCandidate):

platform/mediastream/MediaEndpoint.cpp: Added.

(WebCore::createMediaEndpoint):

platform/mediastream/MediaEndpoint.h: Added.

(WebCore::MediaEndpointClient::~MediaEndpointClient):
(WebCore::MediaEndpoint::~MediaEndpoint):

platform/mediastream/MediaEndpointConfiguration.cpp: Added.

(WebCore::IceServerInfo::IceServerInfo):
(WebCore::MediaEndpointConfiguration::MediaEndpointConfiguration):

platform/mediastream/MediaEndpointConfiguration.h: Added.

(WebCore::IceServerInfo::create):
(WebCore::IceServerInfo::~IceServerInfo):
(WebCore::IceServerInfo::urls):
(WebCore::IceServerInfo::credential):
(WebCore::IceServerInfo::username):
(WebCore::MediaEndpointConfiguration::create):
(WebCore::MediaEndpointConfiguration::iceServers):
(WebCore::MediaEndpointConfiguration::iceTransportPolicy):
(WebCore::MediaEndpointConfiguration::bundlePolicy):

platform/mediastream/MediaEndpointSessionConfiguration.h: Added.

(WebCore::MediaEndpointSessionConfiguration::create):
(WebCore::MediaEndpointSessionConfiguration::~MediaEndpointSessionConfiguration):
(WebCore::MediaEndpointSessionConfiguration::sessionId):
(WebCore::MediaEndpointSessionConfiguration::setSessionId):
(WebCore::MediaEndpointSessionConfiguration::sessionVersion):
(WebCore::MediaEndpointSessionConfiguration::setSessionVersion):
(WebCore::MediaEndpointSessionConfiguration::mediaDescriptions):
(WebCore::MediaEndpointSessionConfiguration::addMediaDescription):
(WebCore::MediaEndpointSessionConfiguration::clone):
(WebCore::MediaEndpointSessionConfiguration::MediaEndpointSessionConfiguration):

platform/mediastream/MediaPayload.h: Added.

(WebCore::MediaPayload::create):
(WebCore::MediaPayload::~MediaPayload):
(WebCore::MediaPayload::type):
(WebCore::MediaPayload::setType):
(WebCore::MediaPayload::encodingName):
(WebCore::MediaPayload::setEncodingName):
(WebCore::MediaPayload::clockRate):
(WebCore::MediaPayload::setClockRate):
(WebCore::MediaPayload::channels):
(WebCore::MediaPayload::setChannels):
(WebCore::MediaPayload::ccmfir):
(WebCore::MediaPayload::setCcmfir):
(WebCore::MediaPayload::nackpli):
(WebCore::MediaPayload::setNackpli):
(WebCore::MediaPayload::nack):
(WebCore::MediaPayload::setNack):
(WebCore::MediaPayload::parameters):
(WebCore::MediaPayload::addParameter):
(WebCore::MediaPayload::clone):
(WebCore::MediaPayload::MediaPayload):

platform/mediastream/PeerMediaDescription.h: Added.

(WebCore::PeerMediaDescription::create):
(WebCore::PeerMediaDescription::~PeerMediaDescription):
(WebCore::PeerMediaDescription::type):
(WebCore::PeerMediaDescription::setType):
(WebCore::PeerMediaDescription::port):
(WebCore::PeerMediaDescription::setPort):
(WebCore::PeerMediaDescription::address):
(WebCore::PeerMediaDescription::setAddress):
(WebCore::PeerMediaDescription::mode):
(WebCore::PeerMediaDescription::setMode):
(WebCore::PeerMediaDescription::payloads):
(WebCore::PeerMediaDescription::addPayload):
(WebCore::PeerMediaDescription::setPayloads):
(WebCore::PeerMediaDescription::rtcpMux):
(WebCore::PeerMediaDescription::setRtcpMux):
(WebCore::PeerMediaDescription::rtcpAddress):
(WebCore::PeerMediaDescription::setRtcpAddress):
(WebCore::PeerMediaDescription::rtcpPort):
(WebCore::PeerMediaDescription::setRtcpPort):
(WebCore::PeerMediaDescription::mediaStreamId):
(WebCore::PeerMediaDescription::setMediaStreamId):
(WebCore::PeerMediaDescription::mediaStreamTrackId):
(WebCore::PeerMediaDescription::setMediaStreamTrackId):
(WebCore::PeerMediaDescription::dtlsSetup):
(WebCore::PeerMediaDescription::setDtlsSetup):
(WebCore::PeerMediaDescription::dtlsFingerprintHashFunction):
(WebCore::PeerMediaDescription::setDtlsFingerprintHashFunction):
(WebCore::PeerMediaDescription::dtlsFingerprint):
(WebCore::PeerMediaDescription::setDtlsFingerprint):
(WebCore::PeerMediaDescription::cname):
(WebCore::PeerMediaDescription::setCname):
(WebCore::PeerMediaDescription::ssrcs):
(WebCore::PeerMediaDescription::addSsrc):
(WebCore::PeerMediaDescription::clearSsrcs):
(WebCore::PeerMediaDescription::iceUfrag):
(WebCore::PeerMediaDescription::setIceUfrag):
(WebCore::PeerMediaDescription::icePassword):
(WebCore::PeerMediaDescription::setIcePassword):
(WebCore::PeerMediaDescription::iceCandidates):
(WebCore::PeerMediaDescription::addIceCandidate):
(WebCore::PeerMediaDescription::source):
(WebCore::PeerMediaDescription::setSource):
(WebCore::PeerMediaDescription::clone):
(WebCore::PeerMediaDescription::PeerMediaDescription):

2:22 PM Changeset in webkit [197052] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking storage/indexeddb/odd-strings.html as flaky on mac-wk1
https://bugs.webkit.org/show_bug.cgi?id=154619

Unreviewed test gardening.

platform/mac-wk1/TestExpectations:

2:11 PM Changeset in webkit [197051] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking imported/w3c/indexeddb/idbcursor-advance.htm as flaky on Yosemite Release WK2
https://bugs.webkit.org/show_bug.cgi?id=154618

Unreviewed test gardening.

platform/mac-wk2/TestExpectations:

1:44 PM Changeset in webkit [197050] by achristensen@apple.com

19 edits in trunk/Source/WebKit2

Fix downloads when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154620

Reviewed by Brady Eidson.

This fixes all the _WKDownload API tests when using NetworkSession.

NetworkProcess/Downloads/DownloadManager.cpp:

(WebKit::DownloadManager::willDecidePendingDownloadDestination):
When we store the NetworkDataTask in m_downloadsWaitingForDestination, we want to remove its owner
from m_pendingDownloads to prevent memory leaks.
(WebKit::DownloadManager::continueDecidePendingDownloadDestination):
If a file exists and the UIProcess has told us to overwrite the file, delete the file
before starting a new download in its place. This used to be done by CFNetwork in
NSURLDownload's setDestination:allowOverwrite:, but the NSURLSession equivalent (setting
NSURLSessionDataTask's _pathToDownloadTaskFile attribute) does not overwrite the file for us.
(WebKit::DownloadManager::cancelDownload):
If a download is canceled while it is waiting for its destination from the UIProcess, the Download
object does not exist yet. Instead, we have a completion handler stored in m_downloadsWaitingForDestination.
In this case, we want to send the UIProcess a DownloadProxy::DidCancel message, which I did through
NetworkProcess::pendingDownloadCanceled because the DownloadManager is not a MessageSender, and then
call the completion handler with PolicyIgnore to cancel the download.
(WebKit::DownloadManager::downloadFinished):

NetworkProcess/Downloads/DownloadManager.h:
NetworkProcess/Downloads/PendingDownload.cpp:

(WebKit::PendingDownload::continueCanAuthenticateAgainstProtectionSpace):
(WebKit::PendingDownload::didBecomeDownload):
(WebKit::PendingDownload::didFailLoading):
(WebKit::PendingDownload::messageSenderConnection):
(WebKit::PendingDownload::didConvertToDownload): Deleted.

NetworkProcess/Downloads/PendingDownload.h:
NetworkProcess/Downloads/cocoa/DownloadCocoa.mm:

(WebKit::Download::cancel):
Send a didCancel message to the UIProcess when a download was cancelled.
Use cancelByProducingResumeData so we can resume canceled downloads.

NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::convertMainResourceLoadToDownload):
didConvertToDownload is needed when using NetworkSession to tell the NetworkResourceLoader
not to call cancel on the NetworkLoad after converting it to a download.

NetworkProcess/NetworkDataTask.h:

(WebKit::NetworkDataTask::setPendingDownload):
(WebKit::NetworkDataTask::pendingDownloadLocation):

NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::convertTaskToDownload):
(WebKit::NetworkLoad::setPendingDownloadID):
(WebKit::NetworkLoad::didReceiveResponseNetworkSession):
Don't call findPendingDownloadLocation as a method on the NetworkDataTask to avoid memory leaks
in DownloadManager.m_pendingDownloads.
(WebKit::NetworkLoad::didBecomeDownload):
Call m_client.didBecomeDownload which is being separated from didConvertToDownload. The former is
called after the NetworkDataTask becomes a Download, the latter is called as soon as
convertMainResourceLoadToDownload is called.

NetworkProcess/NetworkLoadClient.h:
NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::continueWillSendRequest):
(WebKit::NetworkProcess::pendingDownloadCanceled):
Send a DownloadProxy::DidCancel message when a pending download is canceled.
(WebKit::NetworkProcess::findPendingDownloadLocation):
(WebKit::NetworkProcess::continueDecidePendingDownloadDestination):

NetworkProcess/NetworkProcess.h:
NetworkProcess/NetworkProcess.messages.in:
NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::didConvertToDownload):
(WebKit::NetworkResourceLoader::didBecomeDownload):
Separate setting m_didConvertToDownload, which needs to happen before the didReceiveResponse completion
handler is called to tell the NetworkResourceLoader not to call cancel in NetworkResourceLoader::abort,
from deleting the NetworkLoad, which can be done after the NSURLSessionDataTask has been converted to a
NSURLSessionDownloadTask.

NetworkProcess/NetworkResourceLoader.h:
NetworkProcess/cache/NetworkCacheSpeculativeLoad.h:
NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::failureTimerFired):
(WebKit::NetworkDataTask::setPendingDownloadLocation):
(WebKit::NetworkDataTask::transferSandboxExtensionToDownload):
(WebKit::NetworkDataTask::suggestedFilename):
(WebKit::NetworkDataTask::currentRequest):
(WebKit::NetworkDataTask::findPendingDownloadLocation): Deleted.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:didCompleteWithError:]):
Take the downloadID if it failed because we will report that download as failed and not use it again.
(WebKit::NetworkSession::takeDownloadID):

UIProcess/Downloads/DownloadProxy.cpp:

(WebKit::DownloadProxy::decideDestinationWithSuggestedFilenameAsync):
(WebKit::DownloadProxy::decideDestinationWithSuggestedFilename):

1:41 PM Changeset in webkit [197049] by youenn.fablet@crf.canon.fr

19 edits
21 adds in trunk

[Fetch API] Implement Fetch API Response
https://bugs.webkit.org/show_bug.cgi?id=154536

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

New tests covering fetch API.

web-platform-tests/fetch/api/response/response-clone-expected.txt: Added.
web-platform-tests/fetch/api/response/response-clone.html: Added.
web-platform-tests/fetch/api/response/response-consume-expected.txt: Added.
web-platform-tests/fetch/api/response/response-consume.html: Added.
web-platform-tests/fetch/api/response/response-error-expected.txt: Added.
web-platform-tests/fetch/api/response/response-error.html: Added.
web-platform-tests/fetch/api/response/response-idl-expected.txt: Added.
web-platform-tests/fetch/api/response/response-idl.html: Added.
web-platform-tests/fetch/api/response/response-init-001-expected.txt: Added.
web-platform-tests/fetch/api/response/response-init-001.html: Added.
web-platform-tests/fetch/api/response/response-init-002-expected.txt: Added.
web-platform-tests/fetch/api/response/response-init-002.html: Added.
web-platform-tests/fetch/api/response/response-static-error-expected.txt: Added.
web-platform-tests/fetch/api/response/response-static-error.html: Added.
web-platform-tests/fetch/api/response/response-static-redirect-expected.txt: Added.
web-platform-tests/fetch/api/response/response-static-redirect.html: Added.

Source/WebCore:

Tests: imported/w3c/web-platform-tests/fetch/api/response/response-clone.html

imported/w3c/web-platform-tests/fetch/api/response/response-consume.html
imported/w3c/web-platform-tests/fetch/api/response/response-error.html
imported/w3c/web-platform-tests/fetch/api/response/response-idl.html
imported/w3c/web-platform-tests/fetch/api/response/response-init-001.html
imported/w3c/web-platform-tests/fetch/api/response/response-init-002.html
imported/w3c/web-platform-tests/fetch/api/response/response-static-error.html
imported/w3c/web-platform-tests/fetch/api/response/response-static-redirect.html

Adding Fetch Response as FetchResponse class.
Constructor uses a built-in to pre-process the parameters.
Support of body as ReadableStream is missing.

CMakeLists.txt:
DerivedSources.make:
Modules/fetch/FetchBody.h:

(WebCore::FetchBody::empty):

Modules/fetch/FetchResponse.cpp: Added.

(WebCore::JSFetchResponse::body):
(WebCore::isRedirectStatus):
(WebCore::isNullBodyStatus):
(WebCore::FetchResponse::error):
(WebCore::FetchResponse::redirect):
(WebCore::FetchResponse::initializeWith):
(WebCore::FetchResponse::FetchResponse):
(WebCore::FetchResponse::clone):
(WebCore::FetchResponse::type):

Modules/fetch/FetchResponse.h: Added.

(WebCore::FetchResponse::create):
(WebCore::FetchResponse::redirect):
(WebCore::FetchResponse::url):
(WebCore::FetchResponse::redirected):
(WebCore::FetchResponse::status):
(WebCore::FetchResponse::ok):
(WebCore::FetchResponse::statusText):
(WebCore::FetchResponse::headers):
(WebCore::FetchResponse::isDisturbed):
(WebCore::FetchResponse::arrayBuffer):
(WebCore::FetchResponse::formData):
(WebCore::FetchResponse::blob):
(WebCore::FetchResponse::json):
(WebCore::FetchResponse::text):

Modules/fetch/FetchResponse.idl: Added.
Modules/fetch/FetchResponse.js: Added.

(initializeFetchResponse):

WebCore.xcodeproj/project.pbxproj:
bindings/js/WebCoreJSBuiltins.cpp:
bindings/js/WebCoreJSBuiltins.h:

(WebCore::JSBuiltinFunctions::JSBuiltinFunctions):
(WebCore::JSBuiltinFunctions::fetchResponseBuiltins):

LayoutTests:

Adding Response as constructor in global and worker scopes.

js/dom/global-constructors-attributes-dedicated-worker-expected.txt:
js/dom/global-constructors-attributes-expected.txt:
platform/efl/js/dom/global-constructors-attributes-dedicated-worker-expected.txt:
platform/efl/js/dom/global-constructors-attributes-expected.txt:
platform/gtk/js/dom/global-constructors-attributes-expected.txt:
platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt:
platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt:
platform/mac/js/dom/global-constructors-attributes-expected.txt:
platform/win/js/dom/global-constructors-attributes-expected.txt:

1:37 PM Changeset in webkit [197048] by Ryan Haddad

2 edits in branches/safari-601-branch/LayoutTests

Rebaseline fast/writing-mode/broken-ideograph-small-caps.html for Mavericks. rdar://problem/24748658

platform/mac-mavericks/fast/writing-mode/broken-ideograph-small-caps-expected.txt:

1:37 PM Changeset in webkit [197047] by Ryan Haddad

1 edit
1 add in branches/safari-601-branch/LayoutTests

Rebaseline fast/text/small-caps-web-font.html for Mavericks. rdar://problem/24748533

platform/mac-mavericks/fast/text/small-caps-web-font-expected.png: Added.

1:29 PM Changeset in webkit [197046] by timothy@apple.com

2 edits
4 deletes in trunk/Source/WebInspectorUI

Web Inspector: Remove unused Profile.png images

https://bugs.webkit.org/show_bug.cgi?id=154647
rdar://problem/24820825

Reviewed by Brian Burg.

UserInterface/Images/Profile.png: Removed.
UserInterface/Images/Profile@2x.png: Removed.
UserInterface/Images/gtk/Profile.png: Removed.
UserInterface/Images/gtk/Profile@2x.png: Removed.
UserInterface/Views/TimelineIcons.css:

(.profile-icon .icon): Deleted.

1:01 PM Changeset in webkit [197045] by bshafiei@apple.com

5 edits in trunk/Source

Versioning.

1:00 PM Changeset in webkit [197044] by bshafiei@apple.com

1 copy in tags/Safari-602.1.20

New tag.

12:46 PM Changeset in webkit [197043] by commit-queue@webkit.org

23 edits
10 deletes in trunk

Unreviewed, rolling out r197033.
https://bugs.webkit.org/show_bug.cgi?id=154649

"It broke JSC tests when 'this' was loaded from global scope"
(Requested by saamyjoon on #webkit).

Reverted changeset:

"[ES6] Arrow function syntax. Emit loading&putting this/super
only if they are used in arrow function"
https://bugs.webkit.org/show_bug.cgi?id=153981
http://trac.webkit.org/changeset/197033

12:43 PM Changeset in webkit [197042] by sbarati@apple.com

4 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Implement Proxy.Delete
https://bugs.webkit.org/show_bug.cgi?id=154607

Reviewed by Mark Lam.

This patch implements Proxy.Delete with respect to section 9.5.10 of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-delete-p

runtime/ProxyObject.cpp:

(JSC::ProxyObject::getConstructData):
(JSC::ProxyObject::performDelete):
(JSC::ProxyObject::deleteProperty):
(JSC::ProxyObject::deletePropertyByIndex):

runtime/ProxyObject.h:
tests/es6.yaml:
tests/stress/proxy-delete.js: Added.

(assert):
(throw.new.Error.let.handler.get deleteProperty):
(throw.new.Error):
(assert.let.handler.deleteProperty):
(let.handler.deleteProperty):

12:31 PM Changeset in webkit [197041] by andersca@apple.com

6 edits in trunk/Source

Add more WebKitAdditions extension points
https://bugs.webkit.org/show_bug.cgi?id=154648
rdar://problem/24820040

Reviewed by Beth Dakin.

Shared/WebPreferencesDefinitions.h:
UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):

UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration copyWithZone:]):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

12:26 PM Changeset in webkit [197040] by rniwa@webkit.org

5 edits in trunk/Source/WebCore

A function named canTakeNextToken executing blocking scripts is misleading
https://bugs.webkit.org/show_bug.cgi?id=154636

Reviewed by Darin Adler.

Merged canTakeNextToken into pumpTokenizer and extracted pumpTokenizerLoop out of pumpTokenizer.

Inlined m_parserChunkSize in HTMLParserScheduler into checkForYieldBeforeToken, and removed needsYield
from PumpSession in favor of making checkForYieldBeforeToken and checkForYieldBeforeScript return a bool.

No new tests since this is a pure refactoring.

html/parser/HTMLDocumentParser.cpp:

(WebCore::HTMLDocumentParser::canTakeNextToken): Deleted.
(WebCore::HTMLDocumentParser::pumpTokenizerLoop): Extracted from pumpTokenizer. We don't have to check
isStopped() at the beginning since pumpTokenizer asserts that. Return true when session.needsYield would
have been set to true in the old code and return false elsewhere (for stopping or incomplete token).
(WebCore::HTMLDocumentParser::pumpTokenizer):

html/parser/HTMLDocumentParser.h:
html/parser/HTMLParserScheduler.cpp:

(WebCore::PumpSession::PumpSession):
(WebCore::HTMLParserScheduler::HTMLParserScheduler):
(WebCore::HTMLParserScheduler::shouldYieldBeforeExecutingScript): Renamed from checkForYieldBeforeScript.

html/parser/HTMLParserScheduler.h:

(WebCore::HTMLParserScheduler::shouldYieldBeforeToken): Renamed from checkForYieldBeforeToken.
(WebCore::HTMLParserScheduler::isScheduledForResume):
(WebCore::HTMLParserScheduler::checkForYield): Extracted from checkForYieldBeforeToken. Reset
processedTokens to 1 instead of setting it to 0 here and incrementing it later as done in the old code.

12:19 PM Changeset in webkit [197039] by Matt Baker

2 edits in trunk/Source/WebInspectorUI

Web Inspector: TimelineViews should use the recording's end time when entire ruler range is selected
https://bugs.webkit.org/show_bug.cgi?id=154644
<rdar://problem/24818442>

Reviewed by Timothy Hatcher.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView):
(WebInspector.TimelineRecordingContentView.prototype._currentContentViewDidChange):
(WebInspector.TimelineRecordingContentView.prototype._timeRangeSelectionChanged):
Update current timeline view when entire range selected.

(WebInspector.TimelineRecordingContentView.prototype._updateTimes):
Live-update the OverviewTimelineView during recording when entire range selected.

(WebInspector.TimelineRecordingContentView.prototype._updateTimelineViewSelection):
Update timeline view start and end times. When entire range selected, use the recording
end time or current time (while capturing).

11:41 AM WindowsWithoutCygwin edited by mmaxfield@apple.com

(diff)

10:51 AM Changeset in webkit [197038] by dbates@webkit.org

19 edits in trunk

CSP: Enable plugin-types directive by default
https://bugs.webkit.org/show_bug.cgi?id=154420
<rdar://problem/24730322>

Reviewed by Brent Fulgham.

Source/WebCore:

page/csp/ContentSecurityPolicyDirectiveList.cpp:

LayoutTests:

TestExpectations: Mark http/tests/security/contentSecurityPolicy/1.1/plugintypes*.html tests as PASS so that we run them.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid-expected.txt: Update expected result.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid.html: Call runTests() following changes to multiple-iframe-plugin-test.js.

Also add closing tags for <body> and <html> to make the document well-formed.

http/tests/security/contentSecurityPolicy/1.1/plugintypes-mismatched-data.html: Substitute "Content-Security-Policy" for "X-WebKit-CSP";

no behavior change.

http/tests/security/contentSecurityPolicy/1.1/plugintypes-mismatched-url.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-data.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-url-expected.txt: Update expected result.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-notype-url.html: Substitute "Content-Security-Policy" for "X-WebKit-CSP";

no behavior change.

http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-allowed.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-nourl-blocked.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html: Call runTests() following changes to multiple-iframe-plugin-test.js.

Also add closing tags for <body> and <html> to make the document well-formed.

http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-02.html: Ditto.
http/tests/security/contentSecurityPolicy/resources/echo-object-data.pl: Remove logic to support Content Security Policy header X-WebKit-CSP

as it is sufficient to make use of the standardized header Content-Security-Policy.

http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js: Simplify code now that we do not pass query string parameter

http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon-expected.txt: Update expected result based on change to test (below).
http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon.html: Modified to test that we emit

a console warning when plugin-types is used as a source expression.

10:49 AM Changeset in webkit [197037] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

Stackmaps have problems with double register constraints
https://bugs.webkit.org/show_bug.cgi?id=154643

Reviewed by Geoffrey Garen.

This is currently a benign bug. I found it while playing.

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::fillStackmap):

b3/testb3.cpp:

(JSC::B3::testURShiftSelf64):
(JSC::B3::testPatchpointDoubleRegs):
(JSC::B3::zero):
(JSC::B3::run):

10:14 AM Changeset in webkit [197036] by Ryan Haddad

3 edits in trunk/LayoutTests

Rebaseline two W3C tests for ios-simulator after r197014

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt:
platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:

9:56 AM Changeset in webkit [197035] by timothy@apple.com

2 edits in trunk/Source/WebInspectorUI

Follow up fix for the TimelineRuler "select all" mode to fix zeroTime.

https://bugs.webkit.org/show_bug.cgi?id=154561
rdar://problem/24779872

UserInterface/Views/TimelineRuler.js:

(WebInspector.TimelineRuler.prototype.set zeroTime): Change selectionStartTime
before _zeroTime so the check for entireRangeSelected still works.

9:41 AM Changeset in webkit [197034] by Matt Baker

3 edits in trunk/Source/WebInspectorUI

Web Inspector: TimelineRuler should have a "select all" mode
https://bugs.webkit.org/show_bug.cgi?id=154561
<rdar://problem/24779872>

Reviewed by Timothy Hatcher.

TimelineRuler is initialized with a selected range of [0, Number.MAX_VALUE),
indicating the entire timeline is selected. This patch makes it possible to
return the ruler to this state, after being overwritten by a custom selection.
When no custom selection exists, the selection handles are hidden.

UserInterface/Views/TimelineRuler.css:

(.timeline-ruler.selection-hidden > :matches(.selection-drag, .selection-handle, .shaded-area)):
Style for hiding selection controls as needed.

UserInterface/Views/TimelineRuler.js:

(WebInspector.TimelineRuler):
Represent unbounded selection interval as [0, Number.MAX_VALUE).

(WebInspector.TimelineRuler.prototype.set allowsTimeRangeSelection):
Register double-click event listener.

(WebInspector.TimelineRuler.prototype.set zeroTime):
(WebInspector.TimelineRuler.prototype.get entireRangeSelected):
(WebInspector.TimelineRuler.prototype.selectEntireRange):
Let clients check and set the selection of the entire range without needing
to use the internal sentinel values 0 and Number.MAX_VALUE.

(WebInspector.TimelineRuler.prototype._updateSelection):
Update ruler styles and dispatch selection change event when entire
range is selected.

(WebInspector.TimelineRuler.prototype._handleDoubleClick):
If a user-defined selection exists, select the entire range.

9:36 AM Changeset in webkit [197033] by commit-queue@webkit.org

23 edits
10 adds in trunk

[ES6] Arrow function syntax. Emit loading&putting this/super only if they are used in arrow function
https://bugs.webkit.org/show_bug.cgi?id=153981

Patch by Skachkov Oleksandr <gskachkov@gmail.com> on 2016-02-24
Reviewed by Saam Barati.
Source/JavaScriptCore:

In first iteration of implemenation arrow function, we emit load and store variables 'this', 'arguments',
'super', 'new.target' in case if arrow function is exist even variables are not used in arrow function.
Current patch added logic that prevent from emiting those varibles if they are not used in arrow function.
During syntax analyze parser store information about using variables in arrow function inside of
the ordinary function scope and then put to BytecodeGenerator through UnlinkedCodeBlock

bytecode/ExecutableInfo.h:

(JSC::ExecutableInfo::ExecutableInfo):
(JSC::ExecutableInfo::arrowFunctionCodeFeatures):

bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):

bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::arrowFunctionCodeFeatures):
(JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseArguments):
(JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseSuperCall):
(JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseSuperProperty):
(JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseEval):
(JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseThis):
(JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseNewTarget):

bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::generateUnlinkedFunctionCodeBlock):
(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):

bytecode/UnlinkedFunctionExecutable.h:
bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
(JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
(JSC::BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment):
(JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
(JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
(JSC::BytecodeGenerator::isThisUsedInInnerArrowFunction):
(JSC::BytecodeGenerator::isArgumentsUsedInInnerArrowFunction):
(JSC::BytecodeGenerator::isNewTargetUsedInInnerArrowFunction):
(JSC::BytecodeGenerator::isSuperUsedInInnerArrowFunction):
(JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
(JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
(JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):

bytecompiler/BytecodeGenerator.h:
bytecompiler/NodesCodegen.cpp:

(JSC::ThisNode::emitBytecode):
(JSC::EvalFunctionCallNode::emitBytecode):
(JSC::FunctionCallValueNode::emitBytecode):
(JSC::FunctionNode::emitBytecode):

parser/ASTBuilder.h:

(JSC::ASTBuilder::createFunctionMetadata):

parser/Nodes.cpp:

(JSC::FunctionMetadataNode::FunctionMetadataNode):

parser/Nodes.h:
parser/Parser.cpp:

(JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
(JSC::Parser<LexerType>::parseFunctionBody):
(JSC::Parser<LexerType>::parseFunctionInfo):
(JSC::Parser<LexerType>::parseProperty):
(JSC::Parser<LexerType>::parsePrimaryExpression):
(JSC::Parser<LexerType>::parseMemberExpression):

parser/Parser.h:

(JSC::Scope::Scope):
(JSC::Scope::isArrowFunctionBoundary):
(JSC::Scope::innerArrowFunctionFeatures):
(JSC::Scope::setInnerArrowFunctionUseSuperCall):
(JSC::Scope::setInnerArrowFunctionUseSuperProperty):
(JSC::Scope::setInnerArrowFunctionUseEval):
(JSC::Scope::setInnerArrowFunctionUseThis):
(JSC::Scope::setInnerArrowFunctionUseNewTarget):
(JSC::Scope::setInnerArrowFunctionUseArguments):
(JSC::Scope::setInnerArrowFunctionUseEvalAndUseArgumentsIfNeeded):
(JSC::Scope::collectFreeVariables):
(JSC::Scope::mergeInnerArrowFunctionFeatures):
(JSC::Scope::fillParametersForSourceProviderCache):
(JSC::Scope::restoreFromSourceProviderCache):
(JSC::Scope::setIsFunction):
(JSC::Scope::setIsArrowFunction):
(JSC::Parser::closestParentNonArrowFunctionNonLexicalScope):
(JSC::Parser::pushScope):
(JSC::Parser::popScopeInternal):

parser/ParserModes.h:
parser/SourceProviderCacheItem.h:

(JSC::SourceProviderCacheItem::SourceProviderCacheItem):

parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createFunctionMetadata):

tests/stress/arrowfunction-lexical-bind-arguments-non-strict-1.js:
tests/stress/arrowfunction-lexical-bind-arguments-strict.js:
tests/stress/arrowfunction-lexical-bind-newtarget.js:
tests/stress/arrowfunction-lexical-bind-superproperty.js:
tests/stress/arrowfunction-lexical-bind-this-8.js: Added.

LayoutTests:

Added new benchmark tests for invoking arrow function within function, class's constructor and method

js/regress/arrowfunction-call-in-class-constructor-expected.txt: Added.
js/regress/arrowfunction-call-in-class-constructor.html: Added.
js/regress/arrowfunction-call-in-class-method-expected.txt: Added.
js/regress/arrowfunction-call-in-class-method.html: Added.
js/regress/arrowfunction-call-in-function-expected.txt: Added.
js/regress/arrowfunction-call-in-function.html: Added.
js/regress/script-tests/arrowfunction-call-in-class-constructor.js: Added.
js/regress/script-tests/arrowfunction-call-in-class-method.js: Added.
js/regress/script-tests/arrowfunction-call-in-function.js: Added.
js/regress/script-tests/arrowfunction-call.js:

9:26 AM Changeset in webkit [197032] by Ryan Haddad

2 edits in trunk/Source/WebCore

Speculative fix for ios build.

Unreviewed build fix.

bindings/objc/DOM.mm:

(-[DOMNode nextFocusNode]):
(-[DOMNode previousFocusNode]):

9:19 AM Changeset in webkit [197031] by peavo@outlook.com

2 edits in trunk/Source/WebKit/win

[WinCairo] Mark layer as non composited.
https://bugs.webkit.org/show_bug.cgi?id=154640

Reviewed by Alex Christensen.

We need to mark the non composited layer as being non composited.

WebCoreSupport/AcceleratedCompositingContext.cpp:

(AcceleratedCompositingContext::initialize):
(AcceleratedCompositingContext::flushPendingLayerChanges):

9:13 AM Changeset in webkit [197030] by Alan Bujtas

8 edits
2 adds in trunk

Background of an absolutely positioned inline element inside text-indented parent is positioned statically.
https://bugs.webkit.org/show_bug.cgi?id=154019

Reviewed by Simon Fraser.

Source/WebCore:

Test: fast/css3-text/css3-text-indent/text-indent-with-absolute-pos-child.html

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::adjustPositionedBlock):
(WebCore::RenderBlockFlow::updateStaticInlinePositionForChild):

rendering/RenderBlockFlow.h:
rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
(WebCore::RenderBlockFlow::startAlignedOffsetForLine):

rendering/line/LineBreaker.cpp:

(WebCore::LineBreaker::skipTrailingWhitespace):
(WebCore::LineBreaker::skipLeadingWhitespace):

rendering/line/LineInlineHeaders.h: webkit.org/b/154628 fixes the bool vs IndentTextOrNot issue.

(WebCore::setStaticPositions):

LayoutTests:

fast/css3-text/css3-text-indent/text-indent-with-absolute-pos-child-expected.html: Added.
fast/css3-text/css3-text-indent/text-indent-with-absolute-pos-child.html: Added.

9:06 AM Changeset in webkit [197029] by Nikita Vasilyev

13 edits in trunk/Source/WebInspectorUI

Web Inspector: Dim selected items when docked Inspector window is inactive
https://bugs.webkit.org/show_bug.cgi?id=154526
<rdar://problem/24764365>

Abstract selected item and SVG glyph colors into CSS variables.

Reviewed by Timothy Hatcher.

UserInterface/Views/BezierEditor.css:

(.bezier-editor > .bezier-preview > div):

UserInterface/Views/ButtonNavigationItem.css:

(.navigation-bar .item.button > .glyph):
(.navigation-bar .item.button:not(.disabled):active > .glyph):
(.navigation-bar .item.button:not(.disabled):matches(:focus, .activate.activated, .radio.selected) > .glyph):
(.navigation-bar .item.button:not(.disabled):active:matches(:focus, .activate.activated, .radio.selected) > .glyph):
(.navigation-bar .item.button.disabled > .glyph):

UserInterface/Views/ButtonToolbarItem.css:

(.toolbar .item.button:not(.disabled):matches(:focus, .activate.activated) > .glyph):
(.toolbar .item.button:not(.disabled):active:matches(:focus, .activate.activated) > .glyph):

UserInterface/Views/CSSStyleDetailsSidebarPanel.css:

(.sidebar > .panel.details.css-style > .content ~ .options-container > .toggle-class-toggle.selected):
(.sidebar > .panel.details.css-style > .content ~ .options-container > .toggle-class-toggle:not(.selected):hover):

UserInterface/Views/ConsoleMessageView.css:

(.console-user-command.special-user-log > .console-message-text):

UserInterface/Views/DOMTreeOutline.css:

(.tree-outline.dom li.pseudo-class-enabled > .selection::before):

UserInterface/Views/Main.css:

(input[type=range]::-webkit-slider-runnable-track::before):

UserInterface/Views/RadioButtonNavigationItem.css:

(.navigation-bar .item.radio.button.text-only:hover):
(.navigation-bar .item.radio.button.text-only.selected):
(.navigation-bar .item.radio.button.text-only:active):
(.navigation-bar .item.radio.button.text-only.selected:active):

UserInterface/Views/ScopeBar.css:

(.scope-bar > li.multiple:matches(.selected, :hover, :active) > .arrows):
(.scope-bar > li:hover):
(.scope-bar > li.selected):
(.scope-bar > li:active):
(.scope-bar > li.selected:active):

UserInterface/Views/Variables.css:

(:root):
(body.window-inactive):

UserInterface/Views/VisualStyleDetailsPanel.css:

(.sidebar > .panel.details.css-style .visual > .details-section .details-section.has-set-property > .header > span::after):

UserInterface/Views/VisualStyleKeywordIconList.css:

(.visual-style-property-container.keyword-icon-list > .visual-style-property-value-container > .keyword-icon-list-container > .keyword-icon:matches(.computed, .selected)):
(.visual-style-property-container.keyword-icon-list > .visual-style-property-value-container > .keyword-icon-list-container > .keyword-icon.selected):

6:17 AM Changeset in webkit [197028] by youenn.fablet@crf.canon.fr

3 edits in trunk/Source/WebCore

Remove IteratorKey and IteratorValue declarations from JSXX class declarations.
https://bugs.webkit.org/show_bug.cgi?id=154577

Reviewed by Myles C. Maxfield.

No change of behavior.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader): Deleted declaration of IteratorKey and IteratorValue.

bindings/scripts/test/JS/JSTestObj.h:

(WebCore::JSTestObj::createStructure): Rebasing of binding test expectation.

4:14 AM Changeset in webkit [197027] by youenn.fablet@crf.canon.fr

8 edits in trunk

W3C importer should generate all web-platform-tests submodules descriptions
https://bugs.webkit.org/show_bug.cgi?id=154587

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

resources/TestRepositories: Reactivated submodules description generation.
resources/web-platform-tests-modules.json: Updated according modified scripts.

Tools:

Updated submodules description format (removing submodule name as it is the last string of the path really).
Added git subroutines.

Scripts/webkitpy/common/checkout/scm/git.py:

(Git.origin_url):
(Git):
(Git.init_submodules):
(Git.submodules_status):
(Git.deinit_submodules):

Scripts/webkitpy/layout_tests/servers/web_platform_test_server.py:

(WebPlatformTestServer._install_modules): Updated to submodule name removal.

Scripts/webkitpy/w3c/test_downloader.py:

(TestDownloader._git_submodules_description): Updated to cope with recursive submodules (use of submodule init/deinit).

Scripts/webkitpy/w3c/test_importer_unittest.py:

(TestImporterTest.test_submodules_generation): Reactivated partially this test.

4:11 AM Changeset in webkit [197026] by youenn.fablet@crf.canon.fr

5 edits in trunk/Source/WebCore

[Fetch API] Refactor FetchHeaders initialization with iterators
https://bugs.webkit.org/show_bug.cgi?id=154537

Reviewed by Darin Adler.

Covered by existing tests.

Modules/fetch/FetchHeaders.cpp:

(WebCore::initializeWith): Deleted.

Modules/fetch/FetchHeaders.h: Removed FetchHeaders::initializeWith.
Modules/fetch/FetchHeaders.idl: Ditto.
Modules/fetch/FetchHeaders.js:

(initializeFetchHeaders): Making use of iterators to fill headers.

3:13 AM Changeset in webkit [197025] by Carlos Garcia Campos

6 edits in trunk/Source/WebCore

Unreviewed. Fix GObject DOM bindings API break after r196998.

webkit_dom_node_clone_node can now raise exceptions, so rename it
as webkit_dom_node_clone_node_with_error and deprecate the old one
that calls the new one ignoring the error.

bindings/gobject/WebKitDOMDeprecated.cpp:

(webkit_dom_node_clone_node):

bindings/gobject/WebKitDOMDeprecated.h:
bindings/gobject/WebKitDOMDeprecated.symbols:
bindings/gobject/webkitdom.symbols:
bindings/scripts/CodeGeneratorGObject.pm:

(FunctionUsedToNotRaiseException):
(GenerateFunction):

2:41 AM Changeset in webkit [197024] by Carlos Garcia Campos

3 edits
2 adds in trunk

REGRESSION(r195949): [GTK] Test /webkit2/WebKitWebView/insert/link is failing since r195949
https://bugs.webkit.org/show_bug.cgi?id=153747

Reviewed by Michael Catanzaro.

Source/WebCore:

Do not return early when reaching a boundary if there's a range
selection. In that case, the selection will be cleared and
accessibility will be notified.

Test: editing/selection/move-to-line-boundary-clear-selection.html

editing/FrameSelection.cpp:

(WebCore::FrameSelection::modify):

LayoutTests:

Add test to check that moving to line boundary clears the
selection even if the cursor is already at the boundary.

editing/selection/move-to-line-boundary-clear-selection-expected.txt: Added.
editing/selection/move-to-line-boundary-clear-selection.html: Added.

2:12 AM Changeset in webkit [197023] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

[Gstreamer] Mediaplayer should observe the tracks and not the source
https://bugs.webkit.org/show_bug.cgi?id=154582

Patch by Alejandro G. Castro <alex@igalia.com> on 2016-02-24
Reviewed by Philippe Normand.

We have to observe the track objects that define the
mediastream. Replace the source attributes with the new tracks and
use them properly in the class.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:

(WebCore::MediaPlayerPrivateGStreamerOwr::~MediaPlayerPrivateGStreamerOwr):
Make sure we are not observing anymore the tracks after
destruction.
(WebCore::MediaPlayerPrivateGStreamerOwr::hasVideo): Used the track
instead of the source.
(WebCore::MediaPlayerPrivateGStreamerOwr::hasAudio): Ditto.
(WebCore::MediaPlayerPrivateGStreamerOwr::currentTime): Ditto.
(WebCore::MediaPlayerPrivateGStreamerOwr::internalLoad): Ditto.
(WebCore::MediaPlayerPrivateGStreamerOwr::stop): Ditto.
(WebCore::MediaPlayerPrivateGStreamerOwr::trackEnded): Added, new
track observer API, make sure we disable the ended tracks.
(WebCore::MediaPlayerPrivateGStreamerOwr::trackMutedChanged):
Added, new track observer API.
(WebCore::MediaPlayerPrivateGStreamerOwr::trackSettingsChanged):
Added, new track observer API.
(WebCore::MediaPlayerPrivateGStreamerOwr::trackEnabledChanged):
Added, new track observer API.
(WebCore::MediaPlayerPrivateGStreamerOwr::sourceStopped): Deleted,
source observer API.
(WebCore::MediaPlayerPrivateGStreamerOwr::sourceMutedChanged):
Deleted, source observer API.
(WebCore::MediaPlayerPrivateGStreamerOwr::sourceSettingsChanged):
Deleted, source observer API.
(WebCore::MediaPlayerPrivateGStreamerOwr::preventSourceFromStopping):
Deleted, source observer API.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h:

Replaced the attributes representing the source with the tracks
and added the new track observer functions.

2:03 AM Changeset in webkit [197022] by svillar@igalia.com

6 edits in trunk

[css-grid] Swap the order of columns/rows in grid-gap shorthand
https://bugs.webkit.org/show_bug.cgi?id=154584

Source/WebCore:

The latest editor's draft have just changed the order. Now it
should be <grid-row-gap> <grid-column-gap>?.

Reviewed by Darin Adler.

css/CSSParser.cpp:

(WebCore::CSSParser::parseGridGapShorthand):

css/CSSPropertyNames.in:

LayoutTests:

Reviewed by Darin Adler.

fast/css-grid-layout/grid-gutters-get-set-expected.txt:
fast/css-grid-layout/grid-gutters-get-set.html:

1:36 AM Changeset in webkit [197021] by rniwa@webkit.org

6 edits in trunk/Source

Move FocusNavigationScope into FocusController.cpp
https://bugs.webkit.org/show_bug.cgi?id=154630

Reviewed by Darin Adler.

Source/WebCore:

Moved FocusNavigationScope from FocusController.h to FocusController.cpp.

bindings/objc/DOM.mm:

(-[DOMNode nextFocusNode]):
(-[DOMNode previousFocusNode]):

page/FocusController.cpp:

(WebCore::parentInScope):
(WebCore::FocusNavigationScope::firstChildInScope): Moved into FocusNavigationScope.
(WebCore::FocusNavigationScope::lastChildInScope): Ditto.
(WebCore::FocusNavigationScope::nextInScope): Ditto.
(WebCore::FocusNavigationScope::previousInScope): Ditto.
(WebCore::FocusController::findFocusableElementAcrossFocusScope):
(WebCore::FocusController::findFocusableElementRecursively):
(WebCore::FocusController::findFocusableElement):
(WebCore::nextElementWithGreaterTabIndex):
(WebCore::previousElementWithLowerTabIndex):
(WebCore::FocusController::nextFocusableElement): Added a variant for DOM.mm and WebPageIOS.mm.
(WebCore::FocusController::previousFocusableElement): Ditto.
(WebCore::FocusController::nextFocusableElement):
(WebCore::FocusController::previousFocusableElement): Use if instead of for loop for clarity.

page/FocusController.h:

Source/WebKit2:

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::nextAssistableElement):

12:14 AM Changeset in webkit [197020] by adam.bergkvist@ericsson.com

6 edits in trunk

WebRTC: RTCPeerConnection: Sort out responsibilities of close() and stop()
https://bugs.webkit.org/show_bug.cgi?id=154581

Reviewed by Eric Carlson.

Source/WebCore:

Let RTCPeerConnection::close() contain all teardown logic be called by stop().
close() is also responisble for stopping the PeerConnectionBackend and stopping
all RTCRtpSender objects.

Test coverage:
fast/mediastream/RTCRtpSender-replaceTrack.html (updated)
fast/mediastream/RTCPeerConnection-closed-state.html

Modules/mediastream/RTCPeerConnection.cpp:

(WebCore::RTCPeerConnection::close):
(WebCore::RTCPeerConnection::stop):
(WebCore::RTCPeerConnection::RTCPeerConnection): Deleted.

Modules/mediastream/RTCPeerConnection.h:

LayoutTests:

Updated test with replaceTrack() call after the RTCPeerConnection object, that
created the RTCRtpSender, is closed.

fast/mediastream/RTCRtpSender-replaceTrack-expected.txt:
fast/mediastream/RTCRtpSender-replaceTrack.html:

12:12 AM Changeset in webkit [197019] by adam.bergkvist@ericsson.com

4 edits in trunk/Source/WebCore

WebRTC: Add addReceiver() function to PeerConnectionBackendClient interface
https://bugs.webkit.org/show_bug.cgi?id=154583

Reviewed by Eric Carlson.

The addRecevier() notifies the PeerConnectionBackendClient that a new RTCRtpReceiver,
representing an MediaStreamTrack received from a remote peer, is added.

Modules/mediastream/PeerConnectionBackend.h:
Modules/mediastream/RTCPeerConnection.cpp:

(WebCore::RTCPeerConnection::addReceiver):

Modules/mediastream/RTCPeerConnection.h:

Feb 23, 2016:

11:20 PM Changeset in webkit [197018] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

Support building LocaleICU with light ICU (UCONFIG_NO_FORMATTING)
https://bugs.webkit.org/show_bug.cgi?id=154484

Patch by Olivier Blin <Olivier Blin> on 2016-02-23
Reviewed by Darin Adler.

In this mode, this makes LocaleICU with UCONFIG_NO_FORMATTING
essentially the same as LocaleNone, but allows to keep using ICU for
other features.

platform/text/LocaleICU.cpp:

(WebCore::LocaleICU::LocaleICU):
(WebCore::LocaleICU::~LocaleICU):
(WebCore::LocaleICU::initializeLocaleData):

platform/text/LocaleICU.h:

11:11 PM Changeset in webkit [197017] by BJ Burg

2 edits in trunk/Source/WebKit2

Web Inspector: don't run the protocol generator once per output file
https://bugs.webkit.org/show_bug.cgi?id=154635

Reviewed by Myles C. Maxfield.

DerivedSources.make: Use $(firstword, ...) to take just one file as

the target to be built so that the generator runs only once. Make isn't
really designed to coalesce multiple file outputs to one production rule.

11:07 PM Changeset in webkit [197016] by mmaxfield@apple.com

9 edits
3 deletes in trunk/Source/WebCore

Remove dead FontLoader code
https://bugs.webkit.org/show_bug.cgi?id=154625

Reviewed by Darin Adler.

This code has been replaced by FontFaceSet.

No new tests because there is no behavior change.

CMakeLists.txt:
DerivedSources.cpp:
DerivedSources.make:
WebCore.vcxproj/WebCore.vcxproj:
WebCore.vcxproj/WebCore.vcxproj.filters:
WebCore.xcodeproj/project.pbxproj:
css/CSSAllInOne.cpp:
css/FontLoader.cpp: Removed.

(WebCore::LoadFontCallback::create): Deleted.
(WebCore::LoadFontCallback::createFromParams): Deleted.
(WebCore::LoadFontCallback::~LoadFontCallback): Deleted.
(WebCore::LoadFontCallback::familyCount): Deleted.
(WebCore::LoadFontCallback::LoadFontCallback): Deleted.
(WebCore::LoadFontCallback::notifyLoaded): Deleted.
(WebCore::LoadFontCallback::notifyError): Deleted.
(WebCore::FontLoader::loadFontDone): Deleted.
(WebCore::FontLoader::FontLoader): Deleted.
(WebCore::FontLoader::~FontLoader): Deleted.
(WebCore::FontLoader::eventTargetData): Deleted.
(WebCore::FontLoader::ensureEventTargetData): Deleted.
(WebCore::FontLoader::eventTargetInterface): Deleted.
(WebCore::FontLoader::scriptExecutionContext): Deleted.
(WebCore::FontLoader::didLayout): Deleted.
(WebCore::FontLoader::activeDOMObjectName): Deleted.
(WebCore::FontLoader::canSuspendForDocumentSuspension): Deleted.
(WebCore::FontLoader::scheduleEvent): Deleted.
(WebCore::FontLoader::firePendingEvents): Deleted.
(WebCore::FontLoader::beginFontLoading): Deleted.
(WebCore::FontLoader::fontLoaded): Deleted.
(WebCore::FontLoader::loadError): Deleted.
(WebCore::FontLoader::notifyWhenFontsReady): Deleted.
(WebCore::FontLoader::loadingDone): Deleted.
(WebCore::FontLoader::loadFont): Deleted.
(WebCore::FontLoader::checkFont): Deleted.
(WebCore::applyPropertyToCurrentStyle): Deleted.
(WebCore::FontLoader::resolveFontStyle): Deleted.

css/FontLoader.h: Removed.
css/FontLoader.idl: Removed.
page/FrameView.cpp:

11:05 PM Changeset in webkit [197015] by peavo@outlook.com

3 edits in trunk/Source/WebCore

[WinCairo][MediaFoundation] Implement methods to set volume.
https://bugs.webkit.org/show_bug.cgi?id=154580

Reviewed by Alex Christensen.

platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:

(WebCore::MediaPlayerPrivateMediaFoundation::paused):
(WebCore::MediaPlayerPrivateMediaFoundation::setVolume):
(WebCore::MediaPlayerPrivateMediaFoundation::supportsMuting):
(WebCore::MediaPlayerPrivateMediaFoundation::setMuted):
(WebCore::MediaPlayerPrivateMediaFoundation::networkState):

platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

11:04 PM Changeset in webkit [197014] by Chris Dumez

13 edits in trunk

[Reflected] IDL attributes of integer types should use HTML rules for parsing integers
https://bugs.webkit.org/show_bug.cgi?id=154573

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline W3C HTML tests now that more checks are passing.

web-platform-tests/html/dom/reflection-embedded-expected.txt:
web-platform-tests/html/dom/reflection-forms-expected.txt:
web-platform-tests/html/dom/reflection-grouping-expected.txt:
web-platform-tests/html/dom/reflection-metadata-expected.txt:
web-platform-tests/html/dom/reflection-misc-expected.txt:
web-platform-tests/html/dom/reflection-obsolete-expected.txt:
web-platform-tests/html/dom/reflection-sections-expected.txt:
web-platform-tests/html/dom/reflection-tabular-expected.txt:
web-platform-tests/html/dom/reflection-text-expected.txt:

Source/WebCore:

[Reflected] IDL attributes of integer types should use HTML rules for
parsing integers:

https://html.spec.whatwg.org/#reflecting-content-attributes-in-idl-attributes

Those rules are defined here:

We already had an implementation for parsing HTML integers but our reflected
attributes currently use WTFString::toInt() / toUint() instead.

No new tests, already covered by existing tests.

dom/Element.cpp:

(WebCore::Element::getIntegralAttribute):
This method used by the bindings only, for reflected IDL attributed of
type 'long'. Now call parseHTMLInteger() instead of String::toInt() to
parse the content attribute as per the HTML specification.

(WebCore::Element::getUnsignedIntegralAttribute):
This method used by the bindings only, for reflected IDL attributed of
type 'unsigned long'. Now call parseHTMLNonNegativeInteger() instead of
String::toUInt() to parse the content attribute as per the HTML
specification.

html/parser/HTMLParserIdioms.cpp:

(WebCore::parseHTMLIntegerInternal):
Fix a bug in our implementation of parseHTMLIntegerInternal() that
would cause the string "−2147483648" to be parsed as 0. It should
be parsed as −2147483648, which is in the valid range as per:
http://heycam.github.io/webidl/#idl-long

10:43 PM Changeset in webkit [197013] by BJ Burg

21 edits in trunk/Source/JavaScriptCore

Web Inspector: teach the Objective-C protocol generators about --frontend and --backend directives
https://bugs.webkit.org/show_bug.cgi?id=154615
<rdar://problem/24804330>

Reviewed by Timothy Hatcher.

Some of the generated Objective-C bindings are only relevant to code acting as the
protocol backend. Add a per-generator setting mechanism and propagate --frontend and
--backend to all generators. Use the setting in a few generators to omit code that's
not needed.

Also fix a few places where the code emits the wrong Objective-C class prefix.
There is some common non-generated code that must always have the RWIProtocol prefix.

Lastly, change includes to use RWIProtocolJSONObjectPrivate.h instead of *Internal.h. The
macros defined in the internal header now need to be used outside of the framework.

inspector/scripts/codegen/generate_objc_conversion_helpers.py:

Use OBJC_STATIC_PREFIX along with the file name and use different include syntax
depending on the target framework.

inspector/scripts/codegen/generate_objc_header.py:

(ObjCHeaderGenerator.generate_output):
For now, omit generating command protocol and event dispatchers when generating for --frontend.

(ObjCHeaderGenerator._generate_type_interface):
Use OBJC_STATIC_PREFIX along with the unprefixed file name.

inspector/scripts/codegen/generate_objc_internal_header.py:

Use RWIProtocolJSONObjectPrivate.h instead.

inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:

(ObjCProtocolTypesImplementationGenerator.generate_output):
Include the Internal header if it's being generated (only for --backend).

inspector/scripts/codegen/generator.py:

(Generator.init):
(Generator.set_generator_setting):
(Generator):
(Generator.get_generator_setting):
Crib a simple setting system from the Framework class. Make the names more obnoxious.

(Generator.string_for_file_include):
Inspired by the replay input generator, this is a function that uses the proper syntax
for a file include depending on the file's framework and target framework.

inspector/scripts/codegen/objc_generator.py:

(ObjCGenerator.and):
(ObjCGenerator.and.objc_prefix):
(ObjCGenerator):
(ObjCGenerator.objc_type_for_raw_name):
(ObjCGenerator.objc_class_for_raw_name):
Whitelist the 'Automation' domain for the ObjC generators. Revise use of OBJC_STATIC_PREFIX.

inspector/scripts/generate-inspector-protocol-bindings.py:

(generate_from_specification):
Change the generators to use for the frontend. Propagate --frontend and --backend.

inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
inspector/scripts/tests/expected/enum-values.json-result:
inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
inspector/scripts/tests/expected/type-declaration-array-type.json-result:
inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
inspector/scripts/tests/expected/type-declaration-object-type.json-result:
inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:

Rebaseline tests. They now correctly include RWIProtocolJSONObject.h and the like.

9:15 PM Changeset in webkit [197012] by Chris Dumez

5 edits
14 adds in trunk

Align our implementation of Range.createContextualFragment with the specification
https://bugs.webkit.org/show_bug.cgi?id=154627

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline as one more check is passing.

web-platform-tests/dom/nodes/Node-contains-xhtml-expected.txt:

Source/WebCore:

Align our implementation of Range.createContextualFragment with the
specification:

https://w3c.github.io/DOM-Parsing/#widl-Range-createContextualFragment-DocumentFragment-DOMString-fragment

In particular, if the Range's start node is a Document / DocumentFragment,
we now create a new HTMLBodyElement and use it as context element, instead
of throwing an exception.

This also aligns our behavior with Firefox and Chrome.

Tests: imported/blink/fast/dom/Range/create-contextual-fragment-from-bodyless-document-range.html

imported/blink/fast/dom/Range/create-contextual-fragment-from-detached-text-node-range.html
imported/blink/fast/dom/Range/create-contextual-fragment-from-document-fragment-range.html
imported/blink/fast/dom/Range/create-contextual-fragment-from-document-range.html
imported/blink/fast/dom/Range/create-contextual-fragment-from-xhtml-document-range.xhtml
imported/blink/fast/dom/Range/create-contextual-fragment-script-not-ran.html
imported/blink/fast/dom/Range/create-contextual-fragment-script-unmark-already-started.html

dom/Range.cpp:

(WebCore::Range::createContextualFragment):

LayoutTests:

Import some more layout tests from blink to improve coverage for
Range.createContextualFragment().

imported/blink/fast/dom/Range/create-contextual-fragment-from-bodyless-document-range-expected.txt: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-bodyless-document-range.html: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-detached-text-node-range-expected.txt: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-detached-text-node-range.html: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-document-fragment-range-expected.txt: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-document-fragment-range.html: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-document-range-expected.txt: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-document-range.html: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-xhtml-document-range-expected.txt: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-from-xhtml-document-range.xhtml: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-script-not-ran-expected.txt: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-script-not-ran.html: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-script-unmark-already-started-expected.txt: Added.
imported/blink/fast/dom/Range/create-contextual-fragment-script-unmark-already-started.html: Added.

8:39 PM Changeset in webkit [197011] by sbarati@apple.com

2 edits in trunk/Source/JavaScriptCore

arrayProtoFuncConcat doesn't check for an exception after allocating an array
https://bugs.webkit.org/show_bug.cgi?id=154621

Reviewed by Michael Saboff.

runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncConcat):

8:26 PM Changeset in webkit [197010] by mitz@apple.com

24 edits in trunk

[Xcode] Linker errors display mangled names, but no longer should
https://bugs.webkit.org/show_bug.cgi?id=154632

Reviewed by Sam Weinig.

Source/bmalloc:

Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

Source/JavaScriptCore:

Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

Source/ThirdParty/ANGLE:

Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

Source/WebCore:

Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

Source/WebInspectorUI:

Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

Source/WebKit/mac:

Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

Source/WebKit2:

Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

Source/WTF:

Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

Tools:

ContentExtensionTester/Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.
DumpRenderTree/mac/Configurations/Base.xcconfig: Ditto.
LayoutTestRelay/Configurations/Base.xcconfig: Ditto.
MiniBrowser/Configurations/Base.xcconfig: Ditto.
TestWebKitAPI/Configurations/Base.xcconfig: Ditto.
WebEditingTester/Configurations/Base.xcconfig: Ditto.
WebKitTestRunner/Configurations/Base.xcconfig: Ditto.

5:57 PM Changeset in webkit [197009] by barraclough@apple.com

21 edits in trunk/Source

Source/JavaScriptCore:
Remove HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define
https://bugs.webkit.org/show_bug.cgi?id=112323

Reviewed by Chris Dumez.

This feature is controlled by a runtime switch, and defaults off.

Configurations/FeatureDefines.xcconfig:

Source/WebCore:
[WebGL] iOS doesn't respect the alpha:false context creation attribute
https://bugs.webkit.org/show_bug.cgi?id=154617
<rdar://problem/13417023>

Patch by Dean Jackson <dino@apple.com> on 2016-02-23
Reviewed by Sam Weinig.

On iOS we were not respecting the alpha:false context creation
attribute, which meant you always got output that could
have an alpha channel.

The good news is that now we're setting the opaque flag on
the CALayer, there should be a performance improvement when
compositing WebGL into the page.

Test: fast/canvas/webgl/context-attributes-alpha.html

platform/graphics/mac/GraphicsContext3DMac.mm:

(WebCore::GraphicsContext3D::GraphicsContext3D): Don't tell the layer
to be transparent.
(WebCore::GraphicsContext3D::setRenderbufferStorageFromDrawable): Do it
here instead, but based on the value of the alpha attribute.

Source/WebKit/mac:
Remove HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define
https://bugs.webkit.org/show_bug.cgi?id=112323

Reviewed by Chris Dumez.

This feature is controlled by a runtime switch, and defaults off.

Configurations/FeatureDefines.xcconfig:
WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

Source/WebKit2:
Remove HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define
https://bugs.webkit.org/show_bug.cgi?id=112323

Reviewed by Chris Dumez.

This feature is controlled by a runtime switch, and defaults off.

Configurations/FeatureDefines.xcconfig:
WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

Source/WTF:
Remove HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define
https://bugs.webkit.org/show_bug.cgi?id=112323

Reviewed by Chris Dumez.

This feature is controlled by a runtime switch, and defaults off.

wtf/FeatureDefines.h:

5:21 PM Changeset in webkit [197008] by dino@apple.com

3 edits
2 adds in trunk

[WebGL] iOS doesn't respect the alpha:false context creation attribute
https://bugs.webkit.org/show_bug.cgi?id=154617
<rdar://problem/13417023>

Reviewed by Sam Weinig.

Source/WebCore:

On iOS we were not respecting the alpha:false context creation
attribute, which meant you always got output that could
have an alpha channel.

The good news is that now we're setting the opaque flag on
the CALayer, there should be a performance improvement when
compositing WebGL into the page.

Test: fast/canvas/webgl/context-attributes-alpha.html

platform/graphics/mac/GraphicsContext3DMac.mm:

LayoutTests:

Add a test that draws contexts with and without alpha, and then a reference
version that hard-codes the non-alpha colors.

fast/canvas/webgl/context-attributes-alpha-expected.html: Added.
fast/canvas/webgl/context-attributes-alpha.html: Added.

4:53 PM Changeset in webkit [197007] by dbates@webkit.org

8 edits
1 copy
8 adds in trunk

CSP: Enable base-uri directive by default
https://bugs.webkit.org/show_bug.cgi?id=154521
<rdar://problem/24762032>

Reviewed by Brent Fulgham.

Source/WebCore:

Tests: http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored.html

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny.html

page/csp/ContentSecurityPolicyDirectiveList.cpp:

LayoutTests:

TestExpectations:
http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored-expected.txt: Added.
http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored.html: Added.
http/tests/security/contentSecurityPolicy/1.1/base-uri-deny-expected.txt:
http/tests/security/contentSecurityPolicy/1.1/base-uri-deny.html: Repurpose test.
http/tests/security/contentSecurityPolicy/1.1/resources/base-href/resources/safe-script.js: Added.
http/tests/security/contentSecurityPolicy/1.1/resources/safe-script.js: Added.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/base-uri-deny-expected.txt.
http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny.html: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/base-uri-deny.html.
http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon-expected.txt: Update expected result based on change to test (below).
http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon.html: Modified to test that we emit

a console warning when base-uri is used as a source expression.

4:32 PM Changeset in webkit [197006] by barraclough@apple.com

5 edits in trunk/Source/WebCore

Add a mechanism to automatically ramp up timer alignment.
https://bugs.webkit.org/show_bug.cgi?id=154578

Reviewed by Antti Koivisto & Chris Dumez.

Allow timer alignment duration to be proportional to the time the page
has been hidden. This implementation does so by scaling up the throttle
in exponential steps, spaced exponentially far apart.

page/Page.cpp:

(WebCore::Page::Page):

initialize timer.

(WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged):

if setting are changed fully disable/reenable to ensure new setting are read.

(WebCore::Page::setTimerThrottlingEnabled):

enebled bool flag converted to an Optional<double>, tracking time throttling is enabled.

(WebCore::Page::setDOMTimerAlignmentInterval):

when new mechanism is enabled schedule a timer to step up alignment.

(WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):

when timer fires increase alignment.

page/Page.h:
- added new member.
page/Settings.cpp:

(WebCore::Settings::Settings):

initialize new member.

(WebCore::Settings::setHiddenPageDOMTimerThrottlingAutoIncreaseLimit):

added, update new setting. Setting to zero disabled. A non-zero value is a duration in seconds for timer throttling to ramp up to.

page/Settings.h:

(WebCore::Settings::hiddenPageDOMTimerThrottlingAutoIncreases):

read as boolean whether throttle increasing is enabled.

(WebCore::Settings::hiddenPageDOMTimerThrottlingAutoIncreaseLimit):

read throttle increasing limit.

4:30 PM Changeset in webkit [197005] by adachan@apple.com

2 edits in trunk/Source/WebCore

Refactor script that updates fullscreen buttons.
https://bugs.webkit.org/show_bug.cgi?id=154562

Reviewed by Dean Jackson.

Also expose extra property and element in getCurrentControlsStatus() for future testing.

Modules/mediacontrols/mediaControlsApple.js:

(Controller.prototype.updatePictureInPictureButton):
(Controller.prototype.updateFullscreenButtons):

4:20 PM Changeset in webkit [197004] by andersca@apple.com

6 edits in trunk

WKWebView should implement NSCoding
https://bugs.webkit.org/show_bug.cgi?id=137160
Source/WebKit2:

rdar://problem/17380562

Reviewed by Dan Bernstein.

UIProcess/API/Cocoa/WKUserContentController.mm:

(-[WKUserContentController initWithCoder:]):
We need to call [self init] here, so that the wrapper will be initialized.

UIProcess/API/Cocoa/WKWebView.h:

-initWithCoder: shouldn't be unavailable, it should be a designated initializer.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):
Move initialization out into a common method.

(-[WKWebView initWithFrame:configuration:]):
Call -initializeWithConfiguration: here.

(-[WKWebView initWithCoder:]):
Decode everything.

(-[WKWebView encodeWithCoder:]):
Encode everything.

Tools:

Reviewed by Dan Bernstein.

Add tests.

TestWebKitAPI/Tests/WebKit2Cocoa/Coding.mm:

(TEST):

3:41 PM Changeset in webkit [197003] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Fix an API test.

UIProcess/API/APIWebsiteDataStore.cpp:

(API::WebsiteDataStore::defaultDataStore):
Make sure to initialize WebKit2.

3:05 PM Changeset in webkit [197002] by andersca@apple.com

2 edits in trunk/Source/WebKit2

WKWebViewConfiguration should encode more of its properties
https://bugs.webkit.org/show_bug.cgi?id=154611

Reviewed by Sam Weinig.

UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration encodeWithCoder:]):
(-[WKWebViewConfiguration initWithCoder:]):

3:03 PM Changeset in webkit [197001] by keith_miller@apple.com

3 edits in trunk/Source/JavaScriptCore

JSC stress tests' standalone-pre.js should exit on the first failure by default
https://bugs.webkit.org/show_bug.cgi?id=154565

Reviewed by Mark Lam.

tests/stress/regress-151324.js:
tests/stress/resources/standalone-pre.js:

(testFailed):

2:54 PM Changeset in webkit [197000] by andersca@apple.com

3 edits in trunk/Source/WebKit2

WKUserContentController should conform to NSCoding
https://bugs.webkit.org/show_bug.cgi?id=154609

Reviewed by Sam Weinig.

Since we just want to be able to encode WKUserContentController from WKWebViewConfiguration,
we don't encode anything inside WKUserContentController.

UIProcess/API/Cocoa/WKUserContentController.h:
UIProcess/API/Cocoa/WKUserContentController.mm:

(-[WKUserContentController encodeWithCoder:]):
(-[WKUserContentController initWithCoder:]):

2:41 PM Changeset in webkit [196999] by sbarati@apple.com

2 edits in trunk/Source/JavaScriptCore

Make JSObject::getMethod have fewer branches
https://bugs.webkit.org/show_bug.cgi?id=154603

Reviewed by Mark Lam.

Writing code with fewer branches is almost always better.

runtime/JSObject.cpp:

(JSC::JSObject::getMethod):

2:35 PM Changeset in webkit [196998] by rniwa@webkit.org

6 edits
6 adds in trunk

Calling importNode on shadow root causes a crash
https://bugs.webkit.org/show_bug.cgi?id=154570

Reviewed by Anders Carlsson.

Source/WebCore:

The bug was caused by a missing check in cloneNode. Added cloneNodeForBindings to explicitly throw
an NotSupportedError when it's called on a shadow root. We don't clone shadow root when deep-cloning
the tree so we don't have to check that condition.

The behavior of cloneNode is specified at:
http://w3c.github.io/webcomponents/spec/shadow/#the-shadowroot-interface
(it current says we should throw DATA_CLONE_ERR but I have an spec bug filed at
https://github.com/w3c/webcomponents/issues/393)

The behavior of importNode and adoptNode are specified in DOM4 specification:
https://dom.spec.whatwg.org/#dom-document-importnode
https://dom.spec.whatwg.org/#dom-document-adoptnode

Tests: fast/shadow-dom/Document-prototype-adoptNode.html

fast/shadow-dom/Document-prototype-importNode.html
fast/shadow-dom/Node-prototype-cloneNode.html

dom/Document.cpp:

(WebCore::Document::importNode): Throw NotSupportedError when importing a shadow root.

dom/Node.cpp:

(WebCore::Node::cloneNodeForBindings): Added.

dom/Node.h:
dom/Node.idl: Use cloneNodeForBindings here.

LayoutTests:

Added W3C-style testharness tests for calling cloneNode on a shadow root.

Also added tests for adoptNode and importNode.

fast/shadow-dom/Document-prototype-adoptNode-expected.txt: Added.
fast/shadow-dom/Document-prototype-adoptNode.html: Added.
fast/shadow-dom/Document-prototype-importNode-expected.txt: Added.
fast/shadow-dom/Document-prototype-importNode.html: Added.
fast/shadow-dom/Node-prototype-cloneNode-expected.txt: Added.
fast/shadow-dom/Node-prototype-cloneNode.html: Added.

2:29 PM Changeset in webkit [196997] by andersca@apple.com

6 edits in trunk

WKProcessPool should conform to NSCoding
https://bugs.webkit.org/show_bug.cgi?id=154608

Reviewed by Sam Weinig.

Source/WebKit2:

Add +[WKProcessPool _sharedProcessPool] and encode/decode whether the process pool is shared.

UIProcess/API/Cocoa/WKProcessPool.h:
UIProcess/API/Cocoa/WKProcessPool.mm:

(-[WKProcessPool encodeWithCoder:]):
(-[WKProcessPool initWithCoder:]):
(+[WKProcessPool _sharedProcessPool]):

UIProcess/API/Cocoa/WKProcessPoolPrivate.h:

Tools:

Add tests.

TestWebKitAPI/Tests/WebKit2Cocoa/Coding.mm:

(TEST):

2:17 PM Changeset in webkit [196996] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

B3::Value doesn't self-destruct virtually enough (Causes many leaks in LowerDFGToB3::appendOSRExit)
https://bugs.webkit.org/show_bug.cgi?id=154592

Reviewed by Saam Barati.

If Foo has a virtual destructor, then:

foo->Foo::~Foo() does a non-virtual call to Foo's destructor. Even if foo points to a
subclass of Foo that overrides the destructor, this syntax will not call that override.

foo->~Foo() does a virtual call to the destructor, and so if foo points to a subclass, you
get the subclass's override.

b3/B3ControlValue.cpp:

(JSC::B3::ControlValue::convertToJump):
(JSC::B3::ControlValue::convertToOops):

b3/B3Value.cpp:

(JSC::B3::Value::replaceWithIdentity):
(JSC::B3::Value::replaceWithNop):
(JSC::B3::Value::replaceWithPhi):

2:08 PM Changeset in webkit [196995] by andersca@apple.com

5 edits in trunk

WKWebsiteDataStore should conform to NSCoding
https://bugs.webkit.org/show_bug.cgi?id=154605

Reviewed by Dan Bernstein.

Source/WebKit2:

UIProcess/API/Cocoa/WKWebsiteDataStore.h:
UIProcess/API/Cocoa/WKWebsiteDataStore.mm:

(-[WKWebsiteDataStore initWithCoder:]):
(-[WKWebsiteDataStore encodeWithCoder:]):

Tools:

TestWebKitAPI/Tests/WebKit2Cocoa/Coding.mm:

(TEST):

1:49 PM Changeset in webkit [196994] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Fix iOS build.

UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration initWithCoder:]):

1:49 PM Changeset in webkit [196993] by BJ Burg

25 edits in trunk/Source/JavaScriptCore

Web Inspector: the protocol generator's Objective-C name prefix should be configurable
https://bugs.webkit.org/show_bug.cgi?id=154596
<rdar://problem/24794962>

Reviewed by Timothy Hatcher.

In order to support different generated protocol sets that don't have conflicting
file and type names, allow the Objective-C prefix to be configurable based on the
target framework. Each name also has the implicit prefix 'Protocol' appended to the
per-target framework prefix.

For example, the existing protocol for remote inspection has the prefix 'RWI'
and is generated as 'RWIProtocol'. The WebKit framework has the 'Automation' prefix
and is generated as 'AutomationProtocol'.

To make this change, convert ObjCGenerator to be a subclass of Generator and use
the instance method model() to find the target framework and its setting for
'objc_prefix'. Make all ObjC generators subclass ObjCGenerator so they can use
these instance methods that used to be static methods. This is a large but
mechanical change to use self instead of ObjCGenerator.

inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:

(ObjCBackendDispatcherHeaderGenerator):
(ObjCBackendDispatcherHeaderGenerator.init):
(ObjCBackendDispatcherHeaderGenerator.output_filename):
(ObjCBackendDispatcherHeaderGenerator._generate_objc_forward_declarations):
(ObjCBackendDispatcherHeaderGenerator._generate_objc_handler_declarations_for_domain):

inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:

(ObjCConfigurationImplementationGenerator):
(ObjCConfigurationImplementationGenerator.init):
(ObjCConfigurationImplementationGenerator.output_filename):
(ObjCConfigurationImplementationGenerator.generate_output):
(ObjCConfigurationImplementationGenerator._generate_success_block_for_command):
(ObjCConfigurationImplementationGenerator._generate_success_block_for_command.and):
(ObjCConfigurationImplementationGenerator._generate_conversions_for_command):

inspector/scripts/codegen/generate_objc_configuration_header.py:

(ObjCConfigurationHeaderGenerator):
(ObjCConfigurationHeaderGenerator.init):
(ObjCConfigurationHeaderGenerator.output_filename):
(ObjCConfigurationHeaderGenerator.generate_output):
(ObjCConfigurationHeaderGenerator._generate_configuration_interface_for_domains):
(ObjCConfigurationHeaderGenerator._generate_properties_for_domain):

inspector/scripts/codegen/generate_objc_configuration_implementation.py:

(ObjCBackendDispatcherImplementationGenerator):
(ObjCBackendDispatcherImplementationGenerator.init):
(ObjCBackendDispatcherImplementationGenerator.output_filename):
(ObjCBackendDispatcherImplementationGenerator.generate_output):
(ObjCBackendDispatcherImplementationGenerator._generate_configuration_implementation_for_domains):
(ObjCBackendDispatcherImplementationGenerator._generate_ivars):
(ObjCBackendDispatcherImplementationGenerator._generate_handler_setter_for_domain):
(ObjCBackendDispatcherImplementationGenerator._generate_event_dispatcher_getter_for_domain):

inspector/scripts/codegen/generate_objc_conversion_helpers.py:

(ObjCConversionHelpersGenerator):
(ObjCConversionHelpersGenerator.init):
(ObjCConversionHelpersGenerator.output_filename):
(ObjCConversionHelpersGenerator.generate_output):
(ObjCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_declaration):
(ObjCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_member):
(ObjCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_parameter):

inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:

(ObjCFrontendDispatcherImplementationGenerator):
(ObjCFrontendDispatcherImplementationGenerator.init):
(ObjCFrontendDispatcherImplementationGenerator.output_filename):
(ObjCFrontendDispatcherImplementationGenerator.generate_output):
(ObjCFrontendDispatcherImplementationGenerator._generate_event_dispatcher_implementations):
(ObjCFrontendDispatcherImplementationGenerator._generate_event):
(ObjCFrontendDispatcherImplementationGenerator._generate_event.and):
(ObjCFrontendDispatcherImplementationGenerator._generate_event_signature):
(ObjCFrontendDispatcherImplementationGenerator._generate_event_out_parameters):

inspector/scripts/codegen/generate_objc_header.py:

(ObjCHeaderGenerator):
(ObjCHeaderGenerator.init):
(ObjCHeaderGenerator.output_filename):
(ObjCHeaderGenerator.generate_output):
(ObjCHeaderGenerator._generate_forward_declarations):
(ObjCHeaderGenerator._generate_anonymous_enum_for_declaration):
(ObjCHeaderGenerator._generate_anonymous_enum_for_member):
(ObjCHeaderGenerator._generate_anonymous_enum_for_parameter):
(ObjCHeaderGenerator._generate_type_interface):
(ObjCHeaderGenerator._generate_init_method_for_required_members):
(ObjCHeaderGenerator._generate_member_property):
(ObjCHeaderGenerator._generate_command_protocols):
(ObjCHeaderGenerator._generate_single_command_protocol):
(ObjCHeaderGenerator._callback_block_for_command):
(ObjCHeaderGenerator._generate_event_interfaces):
(ObjCHeaderGenerator._generate_single_event_interface):

inspector/scripts/codegen/generate_objc_internal_header.py:

(ObjCInternalHeaderGenerator):
(ObjCInternalHeaderGenerator.init):
(ObjCInternalHeaderGenerator.output_filename):
(ObjCInternalHeaderGenerator.generate_output):
(ObjCInternalHeaderGenerator._generate_event_dispatcher_private_interfaces):

inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:

(ObjCProtocolTypesImplementationGenerator):
(ObjCProtocolTypesImplementationGenerator.init):
(ObjCProtocolTypesImplementationGenerator.output_filename):
(ObjCProtocolTypesImplementationGenerator.generate_output):
(ObjCProtocolTypesImplementationGenerator.generate_type_implementation):
(ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
(ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members.and):
(ObjCProtocolTypesImplementationGenerator._generate_setter_for_member):
(ObjCProtocolTypesImplementationGenerator._generate_setter_for_member.and):
(ObjCProtocolTypesImplementationGenerator._generate_getter_for_member):

inspector/scripts/codegen/models.py:
inspector/scripts/codegen/objc_generator.py:

(ObjCTypeCategory.category_for_type):
(ObjCGenerator):
(ObjCGenerator.init):
(ObjCGenerator.objc_prefix):
(ObjCGenerator.objc_name_for_type):
(ObjCGenerator.objc_enum_name_for_anonymous_enum_declaration):
(ObjCGenerator.objc_enum_name_for_anonymous_enum_member):
(ObjCGenerator.objc_enum_name_for_anonymous_enum_parameter):
(ObjCGenerator.objc_enum_name_for_non_anonymous_enum):
(ObjCGenerator.objc_class_for_type):
(ObjCGenerator.objc_class_for_array_type):
(ObjCGenerator.objc_accessor_type_for_member):
(ObjCGenerator.objc_accessor_type_for_member_internal):
(ObjCGenerator.objc_type_for_member):
(ObjCGenerator.objc_type_for_member_internal):
(ObjCGenerator.objc_type_for_param):
(ObjCGenerator.objc_type_for_param_internal):
(ObjCGenerator.objc_protocol_export_expression_for_variable):
(ObjCGenerator.objc_protocol_import_expression_for_member):
(ObjCGenerator.objc_protocol_import_expression_for_parameter):
(ObjCGenerator.objc_protocol_import_expression_for_variable):
(ObjCGenerator.objc_to_protocol_expression_for_member):
(ObjCGenerator.protocol_to_objc_expression_for_member):

Change the prefix for the 'Test' target framework to be 'Test.' Rebaseline results.

inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
inspector/scripts/tests/expected/enum-values.json-result:
inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
inspector/scripts/tests/expected/type-declaration-array-type.json-result:
inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
inspector/scripts/tests/expected/type-declaration-object-type.json-result:
inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:

1:32 PM Changeset in webkit [196992] by dbates@webkit.org

5 edits in trunk

REGRESSION (r196892): No longer emit error message when CSP form-action directive is used as a source expression
https://bugs.webkit.org/show_bug.cgi?id=154555
<rdar://problem/24776777>

Reviewed by Andy Estes.

Source/WebCore:

The Content Security Policy directive 'script-src' contains 'form-action' as a source expression.
Did you mean 'script-src ...; form-action...' (note the semicolon)?

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::isCSPDirectiveName): Return true if the specified directive name is "form-action".

LayoutTests:

Test that we emit a console error message when form-action is used as a source expression.

http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon-expected.txt:
http/tests/security/contentSecurityPolicy/source-list-parsing-no-semicolon.html: Use form-action as a

1:18 PM Changeset in webkit [196991] by Simon Fraser

14 edits in trunk/Source/WebCore

Lay the groundwork for more constness in StyleResolver-related code
https://bugs.webkit.org/show_bug.cgi?id=154598

Reviewed by Antti Koivisto.

Make some of the leaf functions that are used by the style resolver take
const CSSValues, and use 'auto' more to automatically get const stack variables
when appropriate.

css/CSSBorderImageSliceValue.h:

(WebCore::CSSBorderImageSliceValue::slices):

css/CSSPrimitiveValue.h:

(WebCore::CSSPrimitiveValue::isQuirkValue):

css/FontVariantBuilder.cpp:

(WebCore::extractFontVariantLigatures):
(WebCore::extractFontVariantNumeric):
(WebCore::extractFontVariantEastAsian):

css/FontVariantBuilder.h:
css/StyleBuilderConverter.h:

(WebCore::StyleBuilderConverter::convertReflection):
(WebCore::StyleBuilderConverter::convertGridAutoFlow):

css/StyleBuilderCustom.h:

(WebCore::StyleBuilderCustom::applyValueSize):
(WebCore::StyleBuilderCustom::applyValueStroke):

css/StyleResolver.cpp:

(WebCore::StyleResolver::colorFromPrimitiveValueIsDerivedFromElement):
(WebCore::StyleResolver::colorFromPrimitiveValue):
(WebCore::StyleResolver::createFilterOperations):

css/StyleResolver.h:
css/TransformFunctions.cpp:

(WebCore::transformsForValue):

css/TransformFunctions.h:
rendering/style/StylePendingImage.h:
svg/SVGLength.cpp:

(WebCore::SVGLength::fromCSSPrimitiveValue):

svg/SVGLength.h:

1:17 PM Changeset in webkit [196990] by andersca@apple.com

5 edits in trunk

WKWebViewConfiguration should conform to NSCoding
https://bugs.webkit.org/show_bug.cgi?id=154602

Reviewed by Beth Dakin.

Source/WebKit2:

UIProcess/API/Cocoa/WKWebViewConfiguration.h:
UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration encodeWithCoder:]):
(-[WKWebViewConfiguration initWithCoder:]):

Tools:

TestWebKitAPI/Tests/WebKit2Cocoa/Coding.mm:

(TEST):

12:38 PM Changeset in webkit [196989] by dino@apple.com

4 edits
2 copies
6 adds in trunk/LayoutTests

Add tests for fast click change in r196679
https://bugs.webkit.org/show_bug.cgi?id=154568
<rdar://problem/24782479>

Reviewed by Myles Maxfield.

Bug http://webkit.org/b/154318 made some changes to the fast
click behaviour, but didn't include any tests. Here they are!

fast/events/ios/fast-click-double-tap-sends-click-expected.txt: Added.
fast/events/ios/fast-click-double-tap-sends-click.html: Checks that a double tap on a clickable element sends a click.
fast/events/ios/fast-click-double-tap-zooms-on-image-expected.txt: Added.
fast/events/ios/fast-click-double-tap-zooms-on-image.html: Checks that a double tap on an image can trigger a zoom if there

isn't anything else listening.

fast/events/ios/fast-click-double-tap-zooms-on-text-expected.txt: Added.
fast/events/ios/fast-click-double-tap-zooms-on-text.html: Checks that a double tap on a block of text can trigger a zoom

if there isn't anything else listening.

fast/events/ios/no-fast-click-double-tap-causes-zoom-expected.txt: Added.
fast/events/ios/no-fast-click-double-tap-causes-zoom.html: When we are not in fast click mode, a double tap should

trigger a zoom. This is checking the inverse behaviour to fast-click-double-tap-sends-click.

fast/events/ios/viewport-device-width-allows-double-tap-zoom-out.html: Removed some code that could never be called.
fast/events/ios/viewport-zooms-from-element-to-initial-scale.html: Ditto.
platform/ios-simulator/TestExpectations: Add the new tests.

12:09 PM Changeset in webkit [196988] by ap@apple.com

3 edits in trunk/LayoutTests

REGRESSION (r192251): http/tests/navigation/page-cache-xhr.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=154589

Reviewed by Youenn Fablet.

http/tests/navigation/page-cache-xhr.html: Load a file that exists. The content

doesn't matter, as we expect to navigate away before the load occurs.

http/tests/resources/load-and-stall.cgi: Added cache control, just for a good measure.

12:04 PM Changeset in webkit [196987] by andersca@apple.com

5 edits
1 copy in trunk

WKPreferences should conform to NSCoding
https://bugs.webkit.org/show_bug.cgi?id=154597

Reviewed by Sam Weinig.

Source/WebKit2:

Add NSCoding implementation.

UIProcess/API/Cocoa/WKPreferences.h:
UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences encodeWithCoder:]):
(-[WKPreferences initWithCoder:]):

Tools:

Test encoding and decoding WKPreferences.

TestWebKitAPI/Tests/WebKit2Cocoa/Coding.mm:

(encodeAndDecode):
(TEST):

11:41 AM Changeset in webkit [196986] by mark.lam@apple.com

29 edits
1 add in trunk

Debug assertion failure while loading http://kangax.github.io/compat-table/es6/.
https://bugs.webkit.org/show_bug.cgi?id=154542

Reviewed by Saam Barati.

Source/JavaScriptCore:

According to the spec, the constructors of the following types "are not intended
to be called as a function and will throw an exception". These types are:

TypedArrays - https://tc39.github.io/ecma262/#sec-typedarray-constructors
Map - https://tc39.github.io/ecma262/#sec-map-constructor
Set - https://tc39.github.io/ecma262/#sec-set-constructor
WeakMap - https://tc39.github.io/ecma262/#sec-weakmap-constructor
WeakSet - https://tc39.github.io/ecma262/#sec-weakset-constructor
ArrayBuffer - https://tc39.github.io/ecma262/#sec-arraybuffer-constructor
DataView - https://tc39.github.io/ecma262/#sec-dataview-constructor
Promise - https://tc39.github.io/ecma262/#sec-promise-constructor
Proxy - https://tc39.github.io/ecma262/#sec-proxy-constructor

This patch does the foillowing:

Ensures that these constructors can be called but will throw a TypeError when called.
Makes all these objects use throwConstructorCannotBeCalledAsFunctionTypeError() in their implementation to be consistent.
Change the error message to "calling XXX constructor without new is invalid". This is clearer because the error is likely due to the user forgetting to use the new operator on these constructors.

runtime/Error.h:
runtime/Error.cpp:

(JSC::throwConstructorCannotBeCalledAsFunctionTypeError):

Added a convenience function to throw the TypeError.

runtime/JSArrayBufferConstructor.cpp:

(JSC::constructArrayBuffer):
(JSC::callArrayBuffer):
(JSC::JSArrayBufferConstructor::getCallData):

runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::callGenericTypedArrayView):
(JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):

runtime/JSPromiseConstructor.cpp:

(JSC::callPromise):

runtime/MapConstructor.cpp:

(JSC::callMap):

runtime/ProxyConstructor.cpp:

(JSC::callProxy):
(JSC::ProxyConstructor::getCallData):

runtime/SetConstructor.cpp:

(JSC::callSet):

runtime/WeakMapConstructor.cpp:

(JSC::callWeakMap):

runtime/WeakSetConstructor.cpp:

(JSC::callWeakSet):

tests/es6.yaml:
The typed_arrays_%TypedArray%[Symbol.species].js test now passes.

tests/stress/call-non-calleable-constructors-as-function.js: Added.

(test):

tests/stress/map-constructor.js:

(testCallTypeError):

tests/stress/promise-cannot-be-called.js:

(shouldThrow):

tests/stress/proxy-basic.js:
tests/stress/set-constructor.js:
tests/stress/throw-from-ftl-call-ic-slow-path-cells.js:

(i.catch):

tests/stress/throw-from-ftl-call-ic-slow-path-undefined.js:

(i.catch):

tests/stress/throw-from-ftl-call-ic-slow-path.js:

(i.catch):

tests/stress/weak-map-constructor.js:

(testCallTypeError):

tests/stress/weak-set-constructor.js:
Updated error message string.

LayoutTests:

js/Promise-types-expected.txt:
js/basic-map-expected.txt:
js/basic-set-expected.txt:
js/dom/basic-weakmap-expected.txt:
js/dom/basic-weakset-expected.txt:
js/script-tests/Promise-types.js:
js/typedarray-constructors-expected.txt:
Updated error message string.

11:38 AM Changeset in webkit [196985] by ap@apple.com

2 edits in trunk/Source/JavaScriptCore

ASan build fix.

Let's not export a template function that is only used in InspectorBackendDispatcher.cpp.

inspector/InspectorBackendDispatcher.h:

11:13 AM Changeset in webkit [196984] by achristensen@apple.com

15 edits in trunk/Source/WebKit2

Implement downloads with NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154473

Reviewed by Brady Eidson.

NetworkProcess/Downloads/Download.cpp:

(WebKit::Download::~Download):
(WebKit::Download::didStart):
(WebKit::Download::shouldDecodeSourceDataOfMIMEType):
(WebKit::Download::decideDestinationWithSuggestedFilename):
(WebKit::Download::didCreateDestination):

NetworkProcess/Downloads/Download.h:

(WebKit::Download::downloadID):
(WebKit::Download::setSandboxExtension):

NetworkProcess/Downloads/DownloadManager.cpp:

(WebKit::DownloadManager::startDownload):
(WebKit::DownloadManager::dataTaskBecameDownloadTask):
(WebKit::DownloadManager::continueCanAuthenticateAgainstProtectionSpace):
(WebKit::DownloadManager::continueWillSendRequest):
(WebKit::DownloadManager::willDecidePendingDownloadDestination):
(WebKit::DownloadManager::continueDecidePendingDownloadDestination):
(WebKit::DownloadManager::convertHandleToDownload):

NetworkProcess/Downloads/DownloadManager.h:
NetworkProcess/NetworkDataTask.h:

(WebKit::NetworkDataTask::clearClient):

NetworkDataTasks can now outlive their client, so we need to make client a pointer
with the ability to be nulled from the client's destructor.

(WebKit::NetworkDataTask::pendingDownloadID):
(WebKit::NetworkDataTask::pendingDownload):
(WebKit::NetworkDataTask::setPendingDownload):
(WebKit::NetworkDataTask::pendingDownloadLocation):
(WebKit::NetworkDataTask::client): Deleted.

NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::~NetworkLoad):
(WebKit::NetworkLoad::convertTaskToDownload):
(WebKit::NetworkLoad::setPendingDownloadID):
(WebKit::NetworkLoad::didReceiveResponseNetworkSession):

Don't call the didReceiveResponse completion handler immediately when we know we are
going to turn the load into a download. Instead, save the completion handler until
after we have determined the download destination and set it in the NetworkDataTask.

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::continueWillSendRequest):
(WebKit::NetworkProcess::findPendingDownloadLocation):
(WebKit::NetworkProcess::continueDecidePendingDownloadDestination):
(WebKit::NetworkProcess::setCacheModel):

NetworkProcess/NetworkProcess.h:
NetworkProcess/NetworkProcess.messages.in:
NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::NetworkDataTask):
(WebKit::NetworkDataTask::~NetworkDataTask):
(WebKit::NetworkDataTask::didSendData):
(WebKit::NetworkDataTask::didReceiveChallenge):
(WebKit::NetworkDataTask::didCompleteWithError):
(WebKit::NetworkDataTask::didReceiveResponse):
(WebKit::NetworkDataTask::didReceiveData):
(WebKit::NetworkDataTask::didBecomeDownload):
(WebKit::NetworkDataTask::willPerformHTTPRedirection):
(WebKit::NetworkDataTask::scheduleFailure):
(WebKit::NetworkDataTask::failureTimerFired):
(WebKit::NetworkDataTask::findPendingDownloadLocation):
(WebKit::NetworkDataTask::setPendingDownloadLocation):
(WebKit::NetworkDataTask::tryPasswordBasedAuthentication):
(WebKit::NetworkDataTask::transferSandboxExtensionToDownload):
(WebKit::NetworkDataTask::currentRequest):
(WebKit::NetworkDataTask::cancel):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveData:]):
(-[WKNetworkSessionDelegate URLSession:downloadTask:didFinishDownloadingToURL:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didBecomeDownloadTask:]):

Call didCreateDestination now, which is after the file has been opened on the disk.
A DownloadProxy::DidStart message is now sent from NetworkProcess::findPendingDownloadLocation before
we ask the UIProcess where the download should end up on disk.
Null check the NetworkDataTask's client before using it because it is now a pointer that could be null.

UIProcess/Downloads/DownloadProxy.cpp:

(WebKit::DownloadProxy::shouldDecodeSourceDataOfMIMEType):
(WebKit::DownloadProxy::decideDestinationWithSuggestedFilenameAsync):
(WebKit::DownloadProxy::decideDestinationWithSuggestedFilename):
(WebKit::DownloadProxy::didCreateDestination):

UIProcess/Downloads/DownloadProxy.h:
UIProcess/Downloads/DownloadProxy.messages.in:

10:17 AM Changeset in webkit [196983] by Manuel Rego Casasnovas

3 edits in trunk/Source/WebCore

[css-grid] Avoid duplicated calls to resolution code
https://bugs.webkit.org/show_bug.cgi?id=154336

Reviewed by Sergio Villar Senin.

We were calling GridResolvedPosition::resolveGridPositionsFromStyle()
several times per item.

We can store the GridCoordinates in
RenderGrid::populateExplicitGridAndOrderIterator()
and reuse them in the placement code.
Once RenderGrid::placeItemsOnGrid() is over,
all the items will have a definite position in both axis.

No new tests, no change of behavior.

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::insertItemIntoGrid):
(WebCore::RenderGrid::placeItemsOnGrid):
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
(WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
(WebCore::RenderGrid::cachedGridCoordinate):
(WebCore::RenderGrid::cachedGridSpan):

rendering/RenderGrid.h:

9:57 AM Changeset in webkit [196982] by andersca@apple.com

2 edits in trunk/Tools

Fix build.

TestWebKitAPI/mac/SyntheticBackingScaleFactorWindow.m:

(-[SyntheticBackingScaleFactorWindow initWithContentRect:styleMask:backing:defer:]):

9:42 AM Changeset in webkit [196981] by msaboff@apple.com

2 edits in trunk/PerformanceTests

Unreviewed change to revert extraneous changes made part of change set 196955.

MallocBench/MallocBench/Interpreter.cpp:

(Interpreter::doMallocOp):
(Interpreter::Thread::switchTo):
(writeData): Deleted.

9:40 AM Changeset in webkit [196980] by BJ Burg

6 edits in trunk/Source

Connect WebAutomationSession to its backend dispatcher as if it were an agent and add stub implementations
https://bugs.webkit.org/show_bug.cgi?id=154518
<rdar://problem/24761096>

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

inspector/InspectorBackendDispatcher.h:

Export all the classes since they are used by WebKit::WebAutomationSession.

Source/WebKit2:

Add a domain dispatcher for the 'Automation' domain, and register the
WebAutomationSession itself as the handler for Automation commands.
Stub out these command implementations so the code will compile.

UIProcess/Automation/Automation.json:

Fix the createWindow command's parameters and description.
Add an ErrorMessage string enumeration and document how it can be used
to signal well-known errors to the frontend.

UIProcess/Automation/WebAutomationSession.cpp:

(WebKit::WebAutomationSession::WebAutomationSession):
Add the domain backend dispatcher. It further parses commands that were deemed
valid by the generic dispatcher and match the 'Automation' domain prefix.

(WebKit::WebAutomationSession::getWindows):
(WebKit::WebAutomationSession::openWindow):
(WebKit::WebAutomationSession::closeWindow):
Stub these out with our new ErrorMessage enumeration and a macro to
make this code pattern more readable.

UIProcess/Automation/WebAutomationSession.h:

Add new declarations and members.

9:38 AM Changeset in webkit [196979] by clopez@igalia.com

7 edits
2 adds in trunk/Tools

[GTK] Allow to run the WebKitGTK+ MiniBrowser with the run-benchmark script.
https://bugs.webkit.org/show_bug.cgi?id=153993

Reviewed by Carlos Garcia Campos.

MiniBrowser/gtk/main.c:

(createBrowserWindow): Support --geometry argument for MiniBrowser.
We use this on the gtk_minibrowser_driver script to start the MiniBrowser maximized.

Scripts/webkitpy/benchmark_runner/browser_driver/init.py: Fix loading of subclasses:

The base class has to be loaded first, otherwise any subclase referencing it will give import error.
In OSX the ordering of os.listdir() causes the base class (browser_driver.py) to be first on the list, but not on Linux.
By specifiying the name of the base class file, we ensure it is always loaded first on any system despite the ordering of listdir.

Scripts/webkitpy/benchmark_runner/browser_driver/browser_driver_factory.py:

(BrowserDriverFactory.create):

Scripts/webkitpy/benchmark_runner/browser_driver/gtk_browser_driver.py: Added.

(GTKBrowserDriver):
(GTKBrowserDriver.prepare_env):
(GTKBrowserDriver.restore_env):
(GTKBrowserDriver.close_browsers):
(GTKBrowserDriver._launch_process):
(GTKBrowserDriver._terminate_processes):
(GTKBrowserDriver._screen_size):

Scripts/webkitpy/benchmark_runner/browser_driver/gtk_minibrowser_driver.py: Added.

(GTKMiniBrowserDriver):
(GTKMiniBrowserDriver.prepare_env):
(GTKMiniBrowserDriver.launch_url):
(GTKMiniBrowserDriver.close_browsers):

Scripts/webkitpy/benchmark_runner/http_server_driver/init.py: Fix loading of subclasses. See description above.
Scripts/webkitpy/benchmark_runner/http_server_driver/simple_http_server_driver.py:

(SimpleHTTPServerDriver):
(SimpleHTTPServerDriver.kill_server): Check if the server is still running before trying to terminate it.
Usually the server ends gracefully (no need to terminate it), so this was causing ugly errors on the log.

Scripts/webkitpy/benchmark_runner/utils.py: Fix loading of subclasses. See description above.

(load_subclasses):

8:49 AM Changeset in webkit [196978] by Manuel Rego Casasnovas

5 edits in trunk

[css-grid] Rows track sizes are optional in grid-template shorthand
https://bugs.webkit.org/show_bug.cgi?id=154586

Reviewed by Sergio Villar Senin.

You can omit the size of the rows in grid-template shorthand,
even if you specify a named grid line for the end of the row,
due to a change in the spec back in 2014:
https://github.com/w3c/csswg-drafts/commit/9f660c4183c73c1f5279c46904dc6cb314f76194

Before if you want to specify a named grid line,
you need to set the row size.

Update parsing, so it nows accepts things like:

grid-template: 100px / "a" [bottom];

Source/WebCore:

css/CSSParser.cpp:

(WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
(WebCore::CSSParser::parseGridTemplateShorthand):

8:30 AM Changeset in webkit [196977] by commit-queue@webkit.org

15 edits
3 adds in trunk

[SVG] Update SVG source to return string literals as ASCIILiteral and add test cases for case sensitivity
https://bugs.webkit.org/show_bug.cgi?id=154373

Patch by Nikos Andronikos <nikos.andronikos-webkit@cisra.canon.com.au> on 2016-02-23
Reviewed by Youenn Fablet.

Source/WebCore:

Update SVGAnimatedEnumeration toString method to return ASCIILiteral for string literals and add test cases for
case-sensitivity for these elements.

Test: svg/dom/SVGAnimatedEnumeration-case-sensitive.html

svg/SVGComponentTransferFunctionElement.h:

(WebCore::SVGPropertyTraits<ComponentTransferType>::toString):

svg/SVGFEBlendElement.h:

(WebCore::SVGPropertyTraits<BlendMode>::toString):

svg/SVGFEColorMatrixElement.h:

(WebCore::SVGPropertyTraits<ColorMatrixType>::toString):

svg/SVGFECompositeElement.h:

(WebCore::SVGPropertyTraits<CompositeOperationType>::toString):

svg/SVGFEConvolveMatrixElement.h:

(WebCore::SVGPropertyTraits<EdgeModeType>::toString):

svg/SVGFEDisplacementMapElement.h:

(WebCore::SVGPropertyTraits<ChannelSelectorType>::toString):

svg/SVGFEMorphologyElement.h:

(WebCore::SVGPropertyTraits<MorphologyOperatorType>::toString):

svg/SVGFETurbulenceElement.h:

(WebCore::SVGPropertyTraits<SVGStitchOptions>::toString):
(WebCore::SVGPropertyTraits<TurbulenceType>::toString):

svg/SVGGradientElement.h:

(WebCore::SVGPropertyTraits<SVGSpreadMethodType>::toString):

svg/SVGMarkerElement.h:

(WebCore::SVGPropertyTraits<SVGMarkerUnitsType>::toString):

svg/SVGTextContentElement.h:

(WebCore::SVGPropertyTraits<SVGLengthAdjustType>::toString):

svg/SVGTextPathElement.h:

(WebCore::SVGPropertyTraits<SVGTextPathMethodType>::toString):
(WebCore::SVGPropertyTraits<SVGTextPathSpacingType>::toString):

svg/SVGUnitTypes.h:

(WebCore::SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::toString):

LayoutTests:

Add test cases for case-sensitivity for SVGAnimatedEnumeration elements.

svg/dom/SVGAnimatedEnumeration-case-sensitive-expected.txt: Added.
svg/dom/SVGAnimatedEnumeration-case-sensitive.html: Added.
svg/dom/script-tests/SVGAnimatedEnumeration-case-sensitive.js: Added.

(testCaseSensitivity):

7:51 AM Changeset in webkit [196976] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

[Mac][cmake] Unreviewed speculative buildfix after r196779. Just for fun.

PlatformMac.cmake:

7:46 AM WebKitGTK/2.12.x edited by Ting-Wei Lan

(diff)

6:36 AM Changeset in webkit [196975] by Antti Koivisto

8 edits in trunk/Source

Remove tab suspension code
https://bugs.webkit.org/show_bug.cgi?id=154585

Reviewed by Andreas Kling.

Source/WebCore:

It causes too many problems.

page/Page.cpp:

(WebCore::networkStateChanged):
(WebCore::Page::Page):
(WebCore::Page::setPageActivityState):
(WebCore::Page::setIsVisible):
(WebCore::Page::setIsVisibleInternal):
(WebCore::Page::setIsPrerender):
(WebCore::Page::setResourceUsageOverlayVisible):
(WebCore::Page::canTabSuspend): Deleted.
(WebCore::Page::setIsTabSuspended): Deleted.
(WebCore::Page::setTabSuspensionEnabled): Deleted.
(WebCore::Page::updateTabSuspensionState): Deleted.
(WebCore::Page::tabSuspensionTimerFired): Deleted.

page/Page.h:

(WebCore::Page::setEditable):
(WebCore::Page::isEditable):
(WebCore::Page::setShowAllPlugins):

Source/WebKit2:

Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::WebProcessCreationParameters):
(WebKit::WebProcessCreationParameters::encode):
(WebKit::WebProcessCreationParameters::decode):

Shared/WebProcessCreationParameters.h:
UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::registerUserDefaultsIfNeeded):
(WebKit::WebProcessPool::platformInitializeWebProcess):

WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess):

4:22 AM Changeset in webkit [196974] by commit-queue@webkit.org

1 edit
1 add in trunk/Tools

[GTK] Missing configuration patch for openh264 compilation
https://bugs.webkit.org/show_bug.cgi?id=154455

This patch is required for the openh264 compilation with the
jhbuild-webrtc.modules. The code was implemented by Alessandro
Decina.

Patch by Alejandro G. Castro <alex@igalia.com> on 2016-02-23
Reviewed by Philippe Normand.

gtk/patches/openh264-configure.patch: Added.

1:39 AM Changeset in webkit [196973] by youenn.fablet@crf.canon.fr

6 edits in trunk/Source/WebCore

Refactor DOM Iterator next signature
https://bugs.webkit.org/show_bug.cgi?id=154531

Reviewed by Myles C. Maxfield.

Covered by existing tests.

Modules/fetch/FetchHeaders.cpp:

(WebCore::FetchHeaders::Iterator::next): Using Optional<KeyValuePair> to return iterator value.

Modules/fetch/FetchHeaders.h:
bindings/js/JSKeyValueIterator.h: Using Optional<KeyValuePair> as returned iterator value.

(WebCore::keyValueIteratorForEach):
(WebCore::JSKeyValueIterator<JSWrapper>::next):

css/FontFaceSet.cpp:

(WebCore::FontFaceSet::Iterator::next): Using Optional<KeyValuePair> to return iterator value.

css/FontFaceSet.h:

Feb 22, 2016:

11:59 PM Changeset in webkit [196972] by ryuan.choi@navercorp.com

15 edits
2 deletes in trunk/Source/WebKit2

[EFL] Merge WebView and WebViewEfl
https://bugs.webkit.org/show_bug.cgi?id=154445

Reviewed by Gyuyoung Kim.

PlatformEfl.cmake: Removed WebViewEfl.cpp from source list.
UIProcess/API/C/efl/WKViewEfl.cpp: Removed type cast for WebViewEfl.
UIProcess/API/efl/EwkView.cpp: Ditto.
UIProcess/API/efl/EwkView.h:
UIProcess/API/efl/GestureRecognizer.cpp: Removed type cast for WebViewEfl.
UIProcess/API/efl/WebAccessibility.cpp: Removed unnecessary includes.
UIProcess/API/efl/ewk_view.cpp: Ditto.
UIProcess/efl/ViewClientEfl.cpp: Ditto.
UIProcess/efl/WebColorPickerClient.cpp: Ditto.
UIProcess/efl/WebColorPickerClient.h:
UIProcess/efl/WebColorPickerEfl.cpp:

(WebKit::WebColorPickerEfl::WebColorPickerEfl):

UIProcess/efl/WebColorPickerEfl.h:

(WebKit::WebColorPickerEfl::create):

UIProcess/efl/WebView.cpp:
UIProcess/efl/WebView.h:
UIProcess/efl/WebViewEfl.cpp: Removed.
UIProcess/efl/WebViewEfl.h: Ditto.

11:37 PM Changeset in webkit [196971] by barraclough@apple.com

6 edits in trunk/Source/WebCore

Some timer alignment cleanup.
https://bugs.webkit.org/show_bug.cgi?id=154559

Reviewed by Chris Dumez.

Document shouldn't override Page's timer alignment policy with a lower alignment,
and m_domTimerAlignmentInterval isn't really a Settings, it's just the current state
for the page.

dom/Document.cpp:

(WebCore::Document::timerAlignmentInterval):

take the max of the possible intervals.

page/Page.cpp:

(WebCore::Page::Page):
(WebCore::Page::setTimerThrottlingEnabled):
(WebCore::Page::setDOMTimerAlignmentInterval):

moved here from Settings.

page/Page.h:

(WebCore::Page::domTimerAlignmentInterval):

moved here from Settings.

page/Settings.cpp:

(WebCore::Settings::setDOMTimerAlignmentInterval): Deleted.

moved to Page.

page/Settings.h:

(WebCore::Settings::domTimerAlignmentInterval): Deleted.

moved to Page.

11:18 PM Changeset in webkit [196970] by BJ Burg

9 edits
2 moves
2 adds in trunk/Source

Web Inspector: add 'Automation' protocol domain and generate its backend classes separately in WebKit2
https://bugs.webkit.org/show_bug.cgi?id=154509
<rdar://problem/24759098>

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

Add a new 'WebKit' framework, which is used to generate protocol code
in WebKit2.

Add --backend and --frontend flags to the main generator script.
These allow a framework to trigger two different sets of generators
so they can be separately generated and compiled.

inspector/scripts/codegen/models.py:

(Framework.fromString):
(Frameworks): Add new framework.

inspector/scripts/generate-inspector-protocol-bindings.py:

If neither --backend or --frontend is specified, assume both are wanted.
This matches the behavior for JavaScriptCore and WebInspector frameworks.

(generate_from_specification):
Generate C++ files for the backend and Objective-C files for the frontend.

Source/WebKit2:

Add a new 'Automation' domain which presents an RPC interface
for sending automation commands to an active WebAutomationSession
in the UIProcess via RemoteInspector. This is similar to how the
Inspector backend communicates bidirectionally with a remote
Inspector frontend.

Add build system logic to generate JSON-RPC protocol bindings
for the 'Automation' domain using the inspector code generators.

Move automation-related files that are not API or SPI into their
own directory.

Configurations/BaseTarget.xcconfig: Tell where JavaScriptCore's

private headers are, since that's where the code generators live.

CMakeLists.txt: Look in UIProcess/Automation directory.
PlatformMac.cmake:
DerivedSources.make: Generate protocol bindings for a single domain.

The names of the generated files will be improved in a follow-up patch
so that they do not clash with generated files in JavaScriptCore.

UIProcess/Automation/Automation.json: Added.
UIProcess/Automation/WebAutomationSession.cpp: Renamed from Source/WebKit2/UIProcess/WebAutomationSession.cpp.

(WebKit::WebAutomationSession::WebAutomationSession):
(WebKit::WebAutomationSession::~WebAutomationSession):
Set up a backend dispatcher and frontend router. They will be used later.

(WebKit::WebAutomationSession::dispatchMessageFromRemote):
Forward messages from the remote to the backend dispatcher. When
an agent / command handler is registered, it will receive the message.

(WebKit::WebAutomationSession::connect):
(WebKit::WebAutomationSession::disconnect):
Connenct and disconnect the frontend router to the remote channel.

UIProcess/Automation/WebAutomationSession.h: Renamed from Source/WebKit2/UIProcess/WebAutomationSession.h.
WebKit2.xcodeproj/project.pbxproj: Add and move files.

11:17 PM Changeset in webkit [196969] by mmaxfield@apple.com

13 edits
2 adds in trunk

Font features specified in @font-face blocks don't apply to local() families
https://bugs.webkit.org/show_bug.cgi?id=154554

Reviewed by Dean Jackson.

Source/WebCore:

The correct variables just need to be wired up. In addition, our caches need to be sensitive
to the new data.

Test: css3/font-feature-font-face-local.html

css/CSSFontFaceSource.cpp:

(WebCore::CSSFontFaceSource::font):

platform/graphics/FontCache.cpp:

platform/graphics/FontCache.h:
platform/graphics/FontFeatureSettings.h:

(WebCore::FontFeature::operator!=):
(WebCore::FontFeatureSettings::operator!=):

platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::fontWithFamily):
(WebCore::FontCache::createFontPlatformData):

platform/graphics/mac/ComplexTextControllerCoreText.mm:

(WebCore::ComplexTextController::collectComplexTextRunsForCharacters):

platform/graphics/mac/FontCacheMac.mm:

(WebCore::FontCache::lastResortFallbackFont):

platform/text/TextFlags.h:

(WebCore::FontVariantSettings::operator==):
(WebCore::FontVariantSettings::operator!=):
(WebCore::FontVariantSettings::uniqueValue):

LayoutTests:

css3/font-feature-font-face-local-expected.html: Added.
css3/font-feature-font-face-local.html: Added.

6:31 PM Changeset in webkit [196968] by Matt Baker

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Timelines sidebar and overview attempt to access undefined properties when FPS instrument is absent
https://bugs.webkit.org/show_bug.cgi?id=154567
<rdar://problem/24781536>

Reviewed by Joseph Pecoraro.

UserInterface/Views/TimelineOverview.js:

(WebInspector.TimelineOverview):
The viewMode property should be in a valid state before attempting
to access the current view mode settings.

UserInterface/Views/TimelineSidebarPanel.js:

5:01 PM Changeset in webkit [196967] by sbarati@apple.com

2 edits in trunk/Source/JavaScriptCore

JSGlobalObject doesn't visit ProxyObjectStructure during GC
https://bugs.webkit.org/show_bug.cgi?id=154564

Rubber stamped by Mark Lam.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::visitChildren):

4:51 PM Changeset in webkit [196966] by sbarati@apple.com

18 edits
1 add in trunk/Source/JavaScriptCore

InternalFunction::createSubclassStructure doesn't take into account that get() might throw
https://bugs.webkit.org/show_bug.cgi?id=154548

Reviewed by Mark Lam and Geoffrey Garen and Andreas Kling.

InternalFunction::createSubclassStructure calls newTarget.get(...) which can throw
an exception. Neither the function nor the call sites of the function took this into
account. This patch audits the call sites of the function to make it work in
the event that an exception is thrown.

runtime/BooleanConstructor.cpp:

(JSC::constructWithBooleanConstructor):

runtime/DateConstructor.cpp:

(JSC::constructDate):

runtime/ErrorConstructor.cpp:

(JSC::Interpreter::constructWithErrorConstructor):

runtime/FunctionConstructor.cpp:

(JSC::constructFunctionSkippingEvalEnabledCheck):

runtime/InternalFunction.cpp:

(JSC::InternalFunction::createSubclassStructure):

runtime/JSArrayBufferConstructor.cpp:

(JSC::constructArrayBuffer):

runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayView):

runtime/JSGlobalObject.h:

(JSC::constructEmptyArray):
(JSC::constructArray):
(JSC::constructArrayNegativeIndexed):

runtime/JSPromiseConstructor.cpp:

(JSC::constructPromise):

runtime/MapConstructor.cpp:

(JSC::constructMap):

runtime/NativeErrorConstructor.cpp:

(JSC::Interpreter::constructWithNativeErrorConstructor):

runtime/NumberConstructor.cpp:

(JSC::constructWithNumberConstructor):

runtime/RegExpConstructor.cpp:

(JSC::getRegExpStructure):
(JSC::constructRegExp):
(JSC::constructWithRegExpConstructor):

runtime/SetConstructor.cpp:

(JSC::constructSet):

runtime/StringConstructor.cpp:

(JSC::constructWithStringConstructor):
(JSC::StringConstructor::getConstructData):

runtime/WeakMapConstructor.cpp:

(JSC::constructWeakMap):

runtime/WeakSetConstructor.cpp:

(JSC::constructWeakSet):

tests/stress/create-subclass-structure-might-throw.js: Added.

(assert):

4:48 PM Changeset in webkit [196965] by dbates@webkit.org

2 edits in trunk/Source/WebCore

REGRESSION (r196892): Crash in DocumentLoader::startLoadingMainResource()
https://bugs.webkit.org/show_bug.cgi?id=154563
<rdar://problem/24780678>

Reviewed by Alexey Proskuryakov.

This crash is covered by the test http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html.

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::startLoadingMainResource): Take a ref before calling
DocumentLoader::willSendRequest().

4:40 PM Changeset in webkit [196964] by adachan@apple.com

14 edits in trunk/Source

Implement basic functionality in WebVideoFullscreenInterfaceMac.
https://bugs.webkit.org/show_bug.cgi?id=153241

Reviewed by Beth Dakin.

Source/WebCore:

platform/cocoa/WebVideoFullscreenInterface.h:
platform/mac/WebVideoFullscreenInterfaceMac.h:
platform/mac/WebVideoFullscreenInterfaceMac.mm:

(WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):
(WebCore::WebVideoFullscreenInterfaceMac::enterFullscreen):
(WebCore::WebVideoFullscreenInterfaceMac::exitFullscreen):
(WebCore::WebVideoFullscreenInterfaceMac::cleanupFullscreen):
(WebCore::WebVideoFullscreenInterfaceMac::invalidate):
(WebCore::WebVideoFullscreenInterfaceMac::preparedToReturnToInline):

Source/WebKit2:

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::setupFullscreenWithID):
(WebKit::WebVideoFullscreenManagerProxy::exitFullscreen):
(WebKit::WebVideoFullscreenManagerProxy::preparedToReturnToInline):

UIProcess/PageClient.h:
UIProcess/WebPageProxy.h:
UIProcess/mac/PageClientImpl.h:
UIProcess/mac/PageClientImpl.mm:

(WebKit::PageClientImpl::rootViewToWindow):

UIProcess/mac/WebPageProxyMac.mm:

(WebKit::WebPageProxy::rootViewToWindow):

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::supportsVideoFullscreen):

WebProcess/cocoa/WebVideoFullscreenManager.h:
WebProcess/cocoa/WebVideoFullscreenManager.mm:

(WebKit::WebVideoFullscreenManager::supportsVideoFullscreen):

4:03 PM Changeset in webkit [196963] by msaboff@apple.com

1 edit in trunk/PerformanceTests/MallocBench/MallocBench/Benchmark.cpp

Unreviewed build fix.

Eliminated the include of simple.h as that benchmark wasn't meant to be checked in.

3:03 PM Changeset in webkit [196962] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

Fix build and implement functions to retrieve registers on FreeBSD
https://bugs.webkit.org/show_bug.cgi?id=152258

Patch by Ting-Wei Lan <Ting-Wei Lan> on 2016-02-22
Reviewed by Michael Catanzaro.

heap/MachineStackMarker.cpp:

heap/MachineStackMarker.h:

2:27 PM Changeset in webkit [196961] by Chris Dumez

5 edits in trunk

REGRESSION (r196563): Images not loading on https://klim.co.nz/blog/paypal-sans-design-information/
https://bugs.webkit.org/show_bug.cgi?id=154547
<rdar://problem/24772167>

Reviewed by Gavin Barraclough.

Source/WebCore:

The Website was doing the following:
$ var e = window.addEventListener;
$ e("eventname", handler)

No new tests, extended existing test.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateFunctionCastedThis):

LayoutTests:

Add regression test for <rdar://problem/24772167>.

fast/dom/Window/addEventListener-implicit-this-expected.txt:
fast/dom/Window/addEventListener-implicit-this.html:

2:26 PM Changeset in webkit [196960] by Simon Fraser

10 edits
2 adds in trunk

Repeated background images have the wrong position when using bottom/right-relative background-position
https://bugs.webkit.org/show_bug.cgi?id=154478

Reviewed by Dave Hyatt.
Source/WebCore:

Fix RenderBoxModelObject::calculateBackgroundImageGeometry() to use the right position when
painting repeated background images when right/bottom edges are used.

Also rename BackgroundEdgeOrigin to Edge

Test: fast/images/background-position.html

css/CSSPrimitiveValueMappings.h:

(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator Edge):
(WebCore::CSSPrimitiveValue::operator BackgroundEdgeOrigin): Deleted.

rendering/RenderBoxModelObject.cpp:

(WebCore::resolveEdgeRelativeLength):
(WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):

rendering/style/FillLayer.cpp:

(WebCore::FillLayer::FillLayer):

rendering/style/FillLayer.h:

(WebCore::FillLayer::backgroundXOrigin):
(WebCore::FillLayer::backgroundYOrigin):
(WebCore::FillLayer::setBackgroundXOrigin):
(WebCore::FillLayer::setBackgroundYOrigin):

rendering/style/RenderStyleConstants.cpp:

(WebCore::operator<<):

rendering/style/RenderStyleConstants.h:

LayoutTests:

Enhanced background-position-serialize.html to test values that use right/bottom edge specifiers.

Ref test for background-position.

fast/css/background-position-serialize-expected.txt:
fast/css/background-position-serialize.html:
fast/images/background-position-expected.html: Added.
fast/images/background-position.html: Added.
fast/images/resources/checker.png: Added.

2:24 PM Changeset in webkit [196959] by sbarati@apple.com

3 edits in trunk/Source/JavaScriptCore

JSValue::isConstructor and JSValue::isFunction should check getConstructData and getCallData
https://bugs.webkit.org/show_bug.cgi?id=154552

Reviewed by Mark Lam.

ES6 Proxy breaks our isFunction() and isConstructor() JSValue methods.
They return false on a Proxy with internal Call and Construct
properties. It seems safest, most forward looking, and most adherent
to the specification to check getCallData() and getConstructData() to
implement these functions.

runtime/InternalFunction.cpp:

(JSC::InternalFunction::createSubclassStructure):

runtime/JSCJSValueInlines.h:

(JSC::JSValue::isFunction):
(JSC::JSValue::isConstructor):

2:23 PM Changeset in webkit [196958] by Ryan Haddad

6 edits in trunk/Source

Unreviewed, rolling out r196935.
https://bugs.webkit.org/show_bug.cgi?id=154557

This change causes timeouts and crashes in LayoutTests
(Requested by ryanhaddad on #webkit).

Reverted changeset:

"Enable AVFoundationNSURLSessionEnabled by default"
https://bugs.webkit.org/show_bug.cgi?id=154469
http://trac.webkit.org/changeset/196935

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-22

2:18 PM Changeset in webkit [196957] by Michael Catanzaro

2 edits in trunk/Source/WebCore/platform/gtk/po

[l10n] Updated Polish translation of WebKitGTK+ for 2.12
https://bugs.webkit.org/show_bug.cgi?id=154549

Patch by Piotr Drąg <piotrdrag@gmail.com> on 2016-02-22
Rubber-stamped by Michael Catanzaro.

pl.po:

2:07 PM Changeset in webkit [196956] by keith_miller@apple.com

6 edits
1 add in trunk/Source/JavaScriptCore

Bound functions should use the prototype of the function being bound
https://bugs.webkit.org/show_bug.cgi?id=154195

Reviewed by Geoffrey Garen.

Per ES6, the result of Function.prototype.bind should have the same
prototype as the the function being bound. In order to avoid creating
a new structure each time a function is bound we store the new
structure in our structure map. However, we cannot currently store
structures that have a different GlobalObject than their prototype.
In the rare case that the GlobalObject differs or the prototype of
the bindee is null we create a new structure each time. To further
minimize new structures, as well as making structure lookup faster,
we also store the structure in the RareData of the function we
are binding.

runtime/FunctionRareData.cpp:

(JSC::FunctionRareData::visitChildren):

runtime/FunctionRareData.h:

(JSC::FunctionRareData::getBoundFunctionStructure):
(JSC::FunctionRareData::setBoundFunctionStructure):

runtime/JSBoundFunction.cpp:

(JSC::getBoundFunctionStructure):
(JSC::JSBoundFunction::create):

tests/es6.yaml:
tests/stress/bound-function-uses-prototype.js: Added.

(testChangeProto.foo):
(testChangeProto):
(testBuiltins):

tests/stress/class-subclassing-function.js:

2:02 PM Changeset in webkit [196955] by msaboff@apple.com

42 edits
5 adds in trunk/PerformanceTests

MallocBench: Added recording for nimlang website, new recording details and added new options
https://bugs.webkit.org/show_bug.cgi?id=154485

Reviewed by Geoff Garen.

Added new capabilities to MallocBench. These include:

Added a recording of http://nim-lang.org/docs/lib.html.
Added thread id to the recording and the ability to playback switching threads in MallocBench
Added aligned allocations to recordings and the ability to playback
Added --use-thread-id option to honor recorded thread ids
Added --detailed-report to output remaining allocations by size after playback
Added --no-warmup to not run the warm up iteration

Changed the way that options are passed down to the benchmarks. Instead of passing individual
boolean or numeric option values, just pass a reference the CommandLine itself. Each benchmark
can access the options that are appropriate. The Benchmark class also uses the options for
is parallel, run counts and warm up.

Added thread id and aligned malloc to the Op by noticing that structure padding and Opcode allowed
for another 32 bits of data. Breaking that unused 32 bits into a 16 bit thread id value and a
16 bit log base 2 of the alignment for aligned malloc allowed for existing recordings to playback
without any incompatibilities.

Threaded operation is simulated by creating threads as needed. As long as the next Op's thread id
is the same as the last, operation continues as normal. When the next Op has a different thread id,
we switch to that thread using the shared Op stream to continue playing back. There is a mutex to
assure that only one thread is really running at a time and a condition variable used to wait
that the current thread id matches each block thread's thread id. This doesn't simulate true
concurrent threading, but is instead plays back Ops recorded for multiple thread faithfully.

MallocBench/MallocBench.xcodeproj/project.pbxproj:
MallocBench/MallocBench/Benchmark.cpp:

(deallocateHeap):
(Benchmark::Benchmark):
(Benchmark::runOnce):
(Benchmark::run):

MallocBench/MallocBench/Benchmark.h:

(Benchmark::isValid):

MallocBench/MallocBench/CommandLine.cpp:

(CommandLine::printUsage):

MallocBench/MallocBench/CommandLine.h:

(CommandLine::isValid):
(CommandLine::benchmarkName):
(CommandLine::isParallel):
(CommandLine::useThreadID):
(CommandLine::detailedReport):
(CommandLine::warmUp):
(CommandLine::heapSize):
(CommandLine::runs):

MallocBench/MallocBench/Interpreter.cpp:

(Interpreter::Interpreter):
(Interpreter::run):
(Interpreter::readOps):
(Interpreter::doOnSameThread):
(Interpreter::switchToThread):
(Interpreter::detailedReport):
(compute2toPower):
(writeData):
(Interpreter::doMallocOp):
(Interpreter::Thread::Thread):
(Interpreter::Thread::stop):
(Interpreter::Thread::~Thread):
(Interpreter::Thread::runThread):
(Interpreter::Thread::waitToRun):
(Interpreter::Thread::switchTo):

MallocBench/MallocBench/Interpreter.h:

(Interpreter::Thread::isMainThread):

MallocBench/MallocBench/alloc_free.cpp: Added.

(benchmark_alloc_free):

MallocBench/MallocBench/alloc_free.h: Added.
MallocBench/MallocBench/balloon.cpp:

(benchmark_balloon):

MallocBench/MallocBench/balloon.h:
MallocBench/MallocBench/big.cpp:

(benchmark_big):

MallocBench/MallocBench/big.h:
MallocBench/MallocBench/churn.cpp:

(benchmark_churn):

MallocBench/MallocBench/churn.h:
MallocBench/MallocBench/facebook.cpp:

(benchmark_facebook):

MallocBench/MallocBench/facebook.h:
MallocBench/MallocBench/flickr.cpp:

(benchmark_flickr):
(benchmark_flickr_memory_warning):

MallocBench/MallocBench/flickr.h:
MallocBench/MallocBench/fragment.cpp:

(validate):
(benchmark_fragment):
(benchmark_fragment_iterate):

MallocBench/MallocBench/fragment.h:
MallocBench/MallocBench/list.cpp:

(benchmark_list_allocate):
(benchmark_list_traverse):

MallocBench/MallocBench/list.h:
MallocBench/MallocBench/main.cpp:

(main):

MallocBench/MallocBench/medium.cpp:

(benchmark_medium):

MallocBench/MallocBench/medium.h:
MallocBench/MallocBench/memalign.cpp:

(test):
(benchmark_memalign):

MallocBench/MallocBench/memalign.h:
MallocBench/MallocBench/message.cpp:

(benchmark_message_one):
(benchmark_message_many):

MallocBench/MallocBench/message.h:
MallocBench/MallocBench/nimlang.cpp: Added.

(benchmark_nimlang):

MallocBench/MallocBench/nimlang.h: Added.
MallocBench/MallocBench/nimlang.ops: Added.
MallocBench/MallocBench/realloc.cpp:

(benchmark_realloc):

MallocBench/MallocBench/realloc.h:
MallocBench/MallocBench/reddit.cpp:

(benchmark_reddit):
(benchmark_reddit_memory_warning):

MallocBench/MallocBench/reddit.h:
MallocBench/MallocBench/stress.cpp:

(deallocate):
(benchmark_stress):

MallocBench/MallocBench/stress.h:
MallocBench/MallocBench/stress_aligned.cpp:

(benchmark_stress_aligned):

MallocBench/MallocBench/stress_aligned.h:
MallocBench/MallocBench/theverge.cpp:

(benchmark_theverge):
(benchmark_theverge_memory_warning):

MallocBench/MallocBench/theverge.h:
MallocBench/MallocBench/tree.cpp:

(benchmark_tree_allocate):
(benchmark_tree_traverse):
(benchmark_tree_churn):

MallocBench/MallocBench/tree.h:
MallocBench/run-malloc-benchmarks:

1:40 PM Changeset in webkit [196954] by mmaxfield@apple.com

25 edits
2 adds in trunk

[Font Loading] Split CSSFontSelector into a FontFaceSet implementation and the rest of the class
https://bugs.webkit.org/show_bug.cgi?id=153347

Reviewed by Antti Koivisto.

Source/WebCore:

This patch implements the document.fonts Javascript object. It does so by briding the
already-existing FontFaceSet Javascript object with the CSSFontSelector WebCore object.
CSSFontSelector used to hold internal objects for each @font-face object in the
Document. These objects have been moved into CSSFontFaceSet, so CSSFontSelector simply
just owns an instance of a CSSFontFaceSet.

The lifetime of the FontFace and FontFaceSet objects is a little interesting: because
all the ownership references are inside the WebCore CSSFontFace{,Set} objects, the
higher-level Javascript FontFace{,Set} objects are held through a WeakPtr. This means
that if all the references to these higher-level objects go away, and you re-query the
document for its FontFace objects, you may get a new object (albeit with the same
state as a previous object). However, this won't occur if there are any references to
the old object, which means it is almost not observable.

This patch doesn't implement the relationship between the CSSOM and the FontFace
objects. Changing one should result in a change in the other, but that will be
implemented in a forthcoming patch.

This patch also doesn't alter the lifetime of the CSSFontSelector, which means that all
the Document's fonts may be destroyed and recreated from CSS. There are a few things
which can trigger this. A subsequent patch will make the CSSFontSelector outlive the
Document.

This patch does implement (and test) the ability to add a new FontFace to the Document
to cause a relayout, as well as changing properties of existing FontFace objects already
in the Document to cause a relayout.

Test: fast/text/font-face-set-document.html

Modules/fetch/FetchHeaders.cpp:

(WebCore::FetchHeaders::Iterator::next): Pass an extra argument.

Modules/fetch/FetchHeaders.h:
bindings/js/JSKeyValueIterator.h: The ExecState is necessary to build an external

wrapper from an existing CSSFontFace object.
(WebCore::JSKeyValueIterator<JSWrapper>::next):

css/CSSFontFace.cpp:

(WebCore::CSSFontFace::appendSources): Moved from CSSFontSelector.
(WebCore::CSSFontFace::CSSFontFace):
(WebCore::CSSFontFace::notifyClientsOfFontPropertyChange):
(WebCore::CSSFontFace::setFamilies):
(WebCore::CSSFontFace::calculateStyle): Shared code between CSSFontFaceSet and
CSSFontFace.
(WebCore::CSSFontFace::setStyle): Update to use calculateStyle().
(WebCore::CSSFontFace::calculateWeight): Ditto.
(WebCore::CSSFontFace::setWeight): Update to use caculateWeight().
(WebCore::CSSFontFace::setUnicodeRange): Notify clients.
(WebCore::CSSFontFace::setVariantLigatures): Ditto.
(WebCore::CSSFontFace::setVariantPosition): Ditto.
(WebCore::CSSFontFace::setVariantCaps): Ditto.
(WebCore::CSSFontFace::setVariantNumeric): Ditto.
(WebCore::CSSFontFace::setVariantAlternates): Ditto.
(WebCore::CSSFontFace::setVariantEastAsian): Ditto.
(WebCore::CSSFontFace::setFeatureSettings): Ditto.
(WebCore::CSSFontFace::removeClient):
(WebCore::CSSFontFace::wrapper): Build a new wrapper if one doesn't already
exist. Note that this requires an ExecState to create a promise.
(WebCore::CSSFontFace::setStatus):
(WebCore::CSSFontFace::fontLoaded):
(WebCore::CSSFontFace::pump):
(WebCore::CSSFontFace::font):

css/CSSFontFace.h:
css/CSSFontFaceSet.cpp:

(WebCore::CSSFontFaceSet::CSSFontFaceSet): Moved code from CSSFontSelector.
(WebCore::CSSFontFaceSet::~CSSFontFaceSet):
(WebCore::CSSFontFaceSet::addClient): This object can now have multiple
clients.
(WebCore::CSSFontFaceSet::removeClient):
(WebCore::CSSFontFaceSet::incrementActiveCount): Update for multiple clients.
(WebCore::CSSFontFaceSet::decrementActiveCount): Ditto.
(WebCore::CSSFontFaceSet::hasFace):
(WebCore::CSSFontFaceSet::registerLocalFontFacesForFamily): Moved from
CSSFontSelector.
(WebCore::CSSFontFaceSet::familyNameFromPrimitive): Ditto.
(WebCore::CSSFontFaceSet::addToFacesLookupTable): This helper function can
be used when a property of a FontFace is changed.
(WebCore::CSSFontFaceSet::add): Update to use addToFacesLookupTable().
(WebCore::CSSFontFaceSet::removeFromFacesLookupTable): Same as
addToFacesLookupTable().
(WebCore::CSSFontFaceSet::remove): Update to use removeFromFacesLookupTable().
(WebCore::CSSFontFaceSet::clear):
(WebCore::CSSFontFaceSet::operator[]):
(WebCore::computeFontTraitsMask): Moved from CSSFontSelector.
(WebCore::CSSFontFaceSet::matchingFaces): Update to use new data structures.
(WebCore::FontFaceComparator::FontFaceComparator): Moved from
CSSFontSelector.
(WebCore::FontFaceComparator::operator()):
(WebCore::CSSFontFaceSet::getFontFace): Update to use new data structures.
(WebCore::CSSFontFaceSet::fontStateChanged): Update to use multiple clients.
(WebCore::CSSFontFaceSet::fontPropertyChanged): We must update our internal
data structure if the family name changed.
(WebCore::extractFamilies): Deleted.
(WebCore::familiesIntersect): Deleted.
(WebCore::CSSFontFaceSet::load): Deleted.
(WebCore::CSSFontFaceSet::stateChanged): Deleted.

css/CSSFontFaceSet.h: Now needs to be RefCounted. New data structures are

taken from CSSFontSelector.
(WebCore::CSSFontFaceSetClient::faceFinished):
(WebCore::CSSFontFaceSetClient::fontModified):
(WebCore::CSSFontFaceSetClient::startedLoading):
(WebCore::CSSFontFaceSetClient::completedLoading):

css/CSSFontFaceSource.h:
css/CSSFontSelector.cpp: Move code into CSSFontFaceSet.

(WebCore::CSSFontSelector::CSSFontSelector):
(WebCore::CSSFontSelector::~CSSFontSelector):
(WebCore::CSSFontSelector::fontFaceSet):
(WebCore::CSSFontSelector::isEmpty):
(WebCore::CSSFontSelector::addFontFaceRule):
(WebCore::CSSFontSelector::fontModified):
(WebCore::CSSFontSelector::fontRangesForFamily):
(WebCore::CSSFontSelector::clearDocument):
(WebCore::CSSFontSelector::appendSources): Deleted.
(WebCore::CSSFontSelector::familyNameFromPrimitive): Deleted.
(WebCore::CSSFontSelector::registerLocalFontFacesForFamily): Deleted.
(WebCore::FontFaceComparator::FontFaceComparator): Deleted.
(WebCore::FontFaceComparator::operator()): Deleted.
(WebCore::CSSFontSelector::getFontFace): Deleted.

css/CSSFontSelector.h:
css/CSSSegmentedFontFace.cpp:

(WebCore::CSSSegmentedFontFace::CSSSegmentedFontFace):

css/CSSSegmentedFontFace.h:
css/FontFace.cpp:

(WebCore::FontFace::create):
(WebCore::FontFace::FontFace):
(WebCore::FontFace::createWeakPtr):
(WebCore::FontFace::fontStateChanged):
(WebCore::FontFace::stateChanged): Deleted.

css/FontFace.h:
css/FontFaceSet.cpp:

(WebCore::FontFaceSet::create):
(WebCore::FontFaceSet::FontFaceSet):
(WebCore::FontFaceSet::~FontFaceSet):
(WebCore::FontFaceSet::Iterator::next):
(WebCore::FontFaceSet::has):
(WebCore::FontFaceSet::size):
(WebCore::FontFaceSet::add):
(WebCore::FontFaceSet::remove):
(WebCore::FontFaceSet::clear):
(WebCore::FontFaceSet::load):
(WebCore::FontFaceSet::check):
(WebCore::FontFaceSet::status):
(WebCore::FontFaceSet::canSuspendForDocumentSuspension):
(WebCore::FontFaceSet::faceFinished):

css/FontFaceSet.h:
css/FontFaceSet.idl:
dom/Document.cpp:

(WebCore::Document::fonts):

dom/Document.h:
dom/Document.idl:
svg/SVGFontFaceElement.h:

LayoutTests:

fast/text/font-face-javascript.html:
fast/text/font-face-set-document-expected.txt: Added.
fast/text/font-face-set-document.html: Added.

1:36 PM Changeset in webkit [196953] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix stress test to not print on success.

tests/stress/call-apply-builtin-functions-dont-use-iterators.js:

(catch): Deleted.

1:10 PM Changeset in webkit [196952] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Remove _mockCaptureDevicesEnabled getter and setter
https://bugs.webkit.org/show_bug.cgi?id=154550

Reviewed by Beth Dakin.

The _mockCaptureDevicesEnabled property isn't declared anywhere, and this
should be a WKWebViewConfiguration parameter if we ever want to expose it in the modern API.

UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences _mockCaptureDevicesEnabled]): Deleted.
(-[WKPreferences _setMockCaptureDevicesEnabled:]): Deleted.

12:15 PM Changeset in webkit [196951] by peavo@outlook.com

2 edits in trunk/Source/WebKit/win

[WinCairo] Compile fix.
https://bugs.webkit.org/show_bug.cgi?id=154545

Reviewed by Alex Christensen.

Add missing parameter to GraphicsLayerTextureMapper::updateBackingStoreIncludingSubLayers().

WebCoreSupport/AcceleratedCompositingContext.cpp:

(AcceleratedCompositingContext::flushPendingLayerChanges):

12:07 PM Changeset in webkit [196950] by keith_miller@apple.com

11 edits in trunk/Source/JavaScriptCore

Use Symbol.species in the builtin TypedArray.prototype functions
https://bugs.webkit.org/show_bug.cgi?id=153384

Reviewed by Geoffrey Garen.

This patch adds the use of species constructors to the TypedArray.prototype map and filter
functions. It also adds a new private function typedArrayGetOriginalConstructor that
returns the TypedArray constructor used to originally create a TypedArray instance.

There are no ES6 tests to update for this patch as species creation for these functions is
not tested in the compatibility table.

builtins/TypedArrayPrototype.js:

(map):
(filter):

bytecode/BytecodeIntrinsicRegistry.cpp:

(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):

bytecode/BytecodeIntrinsicRegistry.h:
runtime/CommonIdentifiers.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::typedArrayConstructor):

runtime/JSTypedArrayViewPrototype.cpp:

(JSC::typedArrayViewPrivateFuncGetOriginalConstructor):

runtime/JSTypedArrayViewPrototype.h:
tests/stress/typedarray-filter.js:

(subclasses.typedArrays.map):
(prototype.accept):
(testSpecies):
(accept):
(forEach):
(subclasses.forEach):
(testSpeciesRemoveConstructor):

tests/stress/typedarray-map.js:

(subclasses.typedArrays.map):
(prototype.id):
(testSpecies):
(id):
(forEach):
(subclasses.forEach):
(testSpeciesRemoveConstructor):

11:43 AM Changeset in webkit [196949] by keith_miller@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

Builtins that should not rely on iteration do.
https://bugs.webkit.org/show_bug.cgi?id=154475

Reviewed by Geoffrey Garen.

When changing the behavior of varargs calls to use ES6 iterators the
call builtin function's use of a varargs call was overlooked. The use
of iterators is observable outside the scope of the the call function,
thus it must be reimplemented.

builtins/FunctionPrototype.js:

(call):

tests/stress/call-apply-builtin-functions-dont-use-iterators.js: Added.

(test):
(addAll):
(catch):

11:41 AM Changeset in webkit [196948] by commit-queue@webkit.org

4 edits in trunk

[JSC shell] Don't put empty arguments array to VM.
https://bugs.webkit.org/show_bug.cgi?id=154516

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-22
Reviewed by Geoffrey Garen.

This allows arrowfunction-lexical-bind-arguments-top-level test to pass
in jsc as well as in browser.

Source/JavaScriptCore:

jsc.cpp:

(GlobalObject::finishCreation):

LayoutTests:

js/script-tests/arrowfunction-lexical-bind-arguments-top-level.js:

Removed @ skip annotation.

11:32 AM Changeset in webkit [196947] by commit-queue@webkit.org

12 edits in trunk

[cmake] Moved library setup code to WEBKIT_FRAMEWORK macro.
https://bugs.webkit.org/show_bug.cgi?id=154450

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-22
Reviewed by Alex Christensen.

Source/cmake/WebKitMacros.cmake:

Source/JavaScriptCore:

CMakeLists.txt:

Source/WebCore:

No new tests needed.

CMakeLists.txt:

Source/WebKit:

CMakeLists.txt:

Source/WebKit2:

CMakeLists.txt: Used WebKit2_SOURCES variable instead of separate

WebKit2_DERIVED_SOURCES for compatibility with WEBKIT_FRAMEWORK macro.
There is no real need to separate derived sources from others.

PlatformGTK.cmake: Ditto.

Source/WTF:

wtf/CMakeLists.txt:

11:26 AM Changeset in webkit [196946] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Workaround for ICE in GCC 4.8 appeared in r196846.
https://bugs.webkit.org/show_bug.cgi?id=154535

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-22
Reviewed by Chris Dumez.

No new tests needed.

html/HTMLFormElement.cpp:

(WebCore::HTMLFormElement::autocomplete):

11:24 AM Changeset in webkit [196945] by clopez@igalia.com

2 edits in trunk/Source/WebKit2

[CMake] Unreviewed build fix after r196942.

CMakeLists.txt: WKPluginSiteDataManager.cpp is gone.

11:22 AM Changeset in webkit [196944] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/LayoutTests

Rebaseline Mavericks expected results for emoji tests. rdar://problem/24724222

10:31 AM Changeset in webkit [196943] by commit-queue@webkit.org

13 edits in trunk/Source

Add mechanism to disable memory pressure handling
https://bugs.webkit.org/show_bug.cgi?id=154254
<rdar://problem/24662616>

Patch by Keith Rollin <Keith Rollin> on 2016-02-22
Reviewed by Chris Dumez.

Add a mechanism to disable WebKit's response to memory pressure
triggers. This was asked for by another group for testing purposes.

In order to disable WebKit's memory pressure handling, execute the
following from the command line:

defaults write com.apple.Safari WebKitSuppressMemoryPressureHandler -bool true

To revert to standard behavior, delete the key or set it to False.

This flag is used when a new sub-process is being spawned. The value
is read and stored in an initialization parameter block, which is then
sent to the new sub-process.

In actuality, only the UI, WebContent, and Network processes heed the
flag. The Plugin process isn't instrumented to heed this flag for
three reasons. First, the Plugin process installs its memory pressure
handler in initializeProcess, not initializePluginProcess. This is
contrary to when the other processes install their handlers, which is
in initialize<PluginType>Process, not initializeProcess. So in order
to accomodate the Plugin process, we'd need to modify
ChildProcessInitializationParameters. Doing this is awkward at best,
but also seems to be opposed to what's supposed to be done in
initializeProcess and conveyed in
ChildProcessInitializationParameters. And even if we did add a boolean
to this structure and added support for conveying it through the XPC
port, it would end up being a Plugin process-only boolean in a general
parameter block, which seems asymmetric with the other processes.
Second, there's no convenient Cocoa function called in the flow that
spawns the Plugin process, meaning that there's no convenient place to
call NSUserDefaults to get the flag's value. And third, the Plugin
process doesn't elegantly respond to the memory pressure trigger
anyway. It might terminate itself, but that's it. As for the Database
process, it doesn't seem to support responding to memory pressure at
all, so we don't send it a flag telling it to ignore it.

Internally, the memory pressure handler is suppressed by not calling
MemoryPressureHandler::install() if the flag is set. In the case of
the Network process, the flag is saved so that it can be checked later
in other places that manually kick off the memory pressure handling
procedure.

Source/WebKit/mac:

WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):
(WebInstallMemoryPressureHandler):

Source/WebKit2:

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::lowMemoryHandler):
(WebKit::NetworkProcess::initializeNetworkProcess):

NetworkProcess/NetworkProcess.h:
NetworkProcess/NetworkProcessCreationParameters.cpp:

(WebKit::NetworkProcessCreationParameters::encode):
(WebKit::NetworkProcessCreationParameters::decode):

NetworkProcess/NetworkProcessCreationParameters.h:
Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::encode):
(WebKit::WebProcessCreationParameters::decode):

Shared/WebProcessCreationParameters.h:
UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeWebProcess):
(WebKit::WebProcessPool::platformInitializeNetworkProcess):

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::initializeWebProcess):

10:22 AM Changeset in webkit [196942] by andersca@apple.com

5 edits
2 deletes in trunk/Source/WebKit2

Get rid of WKPluginSiteDataManager
https://bugs.webkit.org/show_bug.cgi?id=154470

Reviewed by Tim Horton.

Shared/API/c/WKBase.h:
UIProcess/API/C/WKContext.cpp:

(WKContextGetPluginSiteDataManager): Deleted.

UIProcess/API/C/WKContext.h:
UIProcess/API/C/WKPluginSiteDataManager.cpp: Removed.

(WKPluginSiteDataManagerGetTypeID): Deleted.
(WKPluginSiteDataManagerGetSitesWithData): Deleted.
(WKPluginSiteDataManagerClearSiteData): Deleted.
(WKPluginSiteDataManagerClearAllSiteData): Deleted.

UIProcess/API/C/WKPluginSiteDataManager.h: Removed.
WebKit2.xcodeproj/project.pbxproj:

10:03 AM Changeset in webkit [196941] by Ryan Haddad

3 edits in trunk/LayoutTests

Rebaseline tests for ios-simulator after W3C HTML/DOM re-sync in r196883

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:
platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt:

10:01 AM Changeset in webkit [196940] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-forms.html for ios-simulator after r196893

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:

9:50 AM Changeset in webkit [196939] by Brent Fulgham

4 edits in trunk/Source/WebKit2

[WK2][Mac] Allow processes to set "fast-dev-casheable" bit
https://bugs.webkit.org/show_bug.cgi?id=154503
<rdar://problem/22920815>

Reviewed by Alexey Proskuryakov.

Update the various sandbox profiles with a declaration that using the
system-fctl to touch the "hot file" flag (to support caching operations)
is allowed.

DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in: Add sandbox permission.
Resources/PlugInSandboxProfiles/com.apple.WebKit.plugin-common.sb: Ditto.
WebProcess/com.apple.WebProcess.sb.in: Ditto.

9:34 AM Changeset in webkit [196938] by commit-queue@webkit.org

3 edits in trunk/Source/bmalloc

Fixed compilation of bmalloc with GCC 4.8 after r196873.
https://bugs.webkit.org/show_bug.cgi?id=154534

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-22
Reviewed by Mark Lam.

See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55382.

bmalloc/LargeChunk.h:
bmalloc/SmallChunk.h:

9:03 AM Changeset in webkit [196937] by commit-queue@webkit.org

9 edits
2 copies
1 delete in trunk/Source

Unreviewed, rolling out r196891.
https://bugs.webkit.org/show_bug.cgi?id=154539

it broke Production builds (Requested by brrian on #webkit).

Reverted changeset:

"Web Inspector: add 'Automation' protocol domain and generate
its backend classes separately in WebKit2"
https://bugs.webkit.org/show_bug.cgi?id=154509
http://trac.webkit.org/changeset/196891

8:36 AM Changeset in webkit [196936] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

REGRESSION (r196620): Web Inspector: Filter bar in the left sidebar is 1px shorter than the console prompt
https://bugs.webkit.org/show_bug.cgi?id=154529

Reviewed by Timothy Hatcher.

UserInterface/Views/NavigationSidebarPanel.css:

(.sidebar > .panel.navigation > .overflow-shadow):

7:59 AM Changeset in webkit [196935] by jer.noble@apple.com

6 edits in trunk/Source

Enable AVFoundationNSURLSessionEnabled by default
https://bugs.webkit.org/show_bug.cgi?id=154469

Reviewed by Sam Weinig.

Source/WebCore:

page/Settings.cpp:

Source/WebKit/mac:

WebView/WebPreferences.mm:

(+[WebPreferences initialize]):

Source/WebKit2:

Shared/WebPreferencesDefinitions.h:

6:08 AM Changeset in webkit [196934] by Manuel Rego Casasnovas

29 edits in trunk

[css-grid] Swap columns and rows in grid-template shorthand
https://bugs.webkit.org/show_bug.cgi?id=154472

Reviewed by Darin Adler.

The spec was modified past December to change the order of
columns and rows in the grid-template shorthand:
https://github.com/w3c/csswg-drafts/commit/f6c7691679a519017a80ebae44fd86c3eae5c5f9

Updated the parsing and modified the tests to follow the new syntax.

Source/WebCore:

css/CSSParser.cpp:

(WebCore::CSSParser::parseGridTemplateColumns):
(WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
(WebCore::CSSParser::parseGridTemplateShorthand):
(WebCore::CSSParser::parseGridTemplateRowsAndAreas): Renamed to
parseGridTemplateRowsAndAreasAndColumns().

css/CSSParser.h:

LayoutTests:

fast/css-grid-layout/absolute-positioning-definite-sizes.html:
fast/css-grid-layout/flex-content-distribution.html:
fast/css-grid-layout/grid-align-content-vertical-lr.html:
fast/css-grid-layout/grid-align-content-vertical-rl.html:
fast/css-grid-layout/grid-align-content.html:
fast/css-grid-layout/grid-gutters-and-alignment.html:
fast/css-grid-layout/grid-gutters-and-flex-content.html:
fast/css-grid-layout/grid-gutters-and-tracks.html:
fast/css-grid-layout/grid-justify-content-vertical-lr.html:
fast/css-grid-layout/grid-justify-content-vertical-rl.html:
fast/css-grid-layout/grid-justify-content.html:
fast/css-grid-layout/grid-shorthand-get-set.html:
fast/css-grid-layout/grid-template-shorthand-get-set.html:
fast/css-grid-layout/relayout-align-items-changed.html:
fast/css-grid-layout/relayout-align-self-changed.html:
fast/css-grid-layout/relayout-indefinite-heights.html:
fast/css-grid-layout/relayout-justify-items-changed.html:
fast/css-grid-layout/relayout-justify-self-changed.html:
fast/repaint/align-items-overflow-change.html:
fast/repaint/align-self-change.html:
fast/repaint/align-self-overflow-change.html:
fast/repaint/justify-items-change.html:
fast/repaint/justify-items-overflow-change.html:
fast/repaint/justify-self-change.html:
fast/repaint/justify-self-overflow-change.html:

3:49 AM Changeset in webkit [196933] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196809 - [GStreamer] clean-up various leaks
https://bugs.webkit.org/show_bug.cgi?id=154285

Reviewed by Carlos Garcia Campos.

platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:

(webkit_web_audio_src_init): Take full ownership of the GstTask.

platform/graphics/gstreamer/GRefPtrGStreamer.cpp:

(WTF::adoptGRef): Null pointer support in ASSERTs.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::initializeGStreamerAndRegisterWebKitElements): Take full ownership of the GstElementFactory pointers.
(WebCore::MediaPlayerPrivateGStreamer::isAvailable): Ditto.

3:44 AM Changeset in webkit [196932] by Carlos Garcia Campos

7 edits in releases/WebKitGTK/webkit-2.10/Source

Merge r196803 - [GTK] Limit the number of tiles according to the visible area
https://bugs.webkit.org/show_bug.cgi?id=126122

Reviewed by Carlos Garcia Campos.

Source/WebCore:

TextureMapperTiledBackingStore creates tiles for whole layer bounds, which
means it creates the huge amount of textures if there is an excessively big
layer. Not only it wastes the memory and the CPU time, it even can crash GPU
drivers.

This patch modifies TextureMapperTiledBackingStore to take into account the
visible area with a coverage multiplier when creating tiles.

platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:

(WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
Set a flag to recalculate the visible area of the layer when there are
geometric changes.
(WebCore::GraphicsLayerTextureMapper::setContentsToImage):
(WebCore::GraphicsLayerTextureMapper::flushCompositingStateForThisLayerOnly):
(WebCore::GraphicsLayerTextureMapper::updateBackingStoreIncludingSubLayers):
(WebCore::GraphicsLayerTextureMapper::updateBackingStoreIfNeeded):
(WebCore::GraphicsLayerTextureMapper::markVisibleRectAsDirty):
(WebCore::GraphicsLayerTextureMapper::selfOrAncestorHasActiveTransformAnimation):
(WebCore::GraphicsLayerTextureMapper::computeTransformedVisibleRect):
Compute the inverse transform matrix to map a global visible are to
the local visible area.
(WebCore::clampToContentsRectIfRectIsInfinite):
(WebCore::GraphicsLayerTextureMapper::transformedVisibleRect):

platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:

(WebCore::TextureMapperTiledBackingStore::paintToTextureMapper):
In HiDPI, the directly composited image is uploaded to the unscaled
texture to reduce memory usages. So we should apply device scale
factor to render it correctly.
(WebCore::TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded):
Create tiles which covered by visible rect with a coverage multiplier.

Source/WebKit2:

WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:

(WebKit::LayerTreeHostGtk::initialize): Because we creates
nonCompositingLayer with a size of current view, we should not apply
the currently visible rect when creating / deleting tiles.
(WebKit::LayerTreeHostGtk::flushPendingLayerChanges): Passes the current
visible rect to the GraphicsLayers.

2:53 AM Changeset in webkit [196931] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196666 - Every RenderLayer should not have to remove itself from the scrollableArea set
https://bugs.webkit.org/show_bug.cgi?id=154311

Reviewed by Zalan Bujtas.

A subset of RenderLayers are are scrollable, and get registered on the FrameView,
but we pay the cost of a hash lookup for removal on every RenderLayer, which is a waste.

Store a bit that tells RenderLayer that it's in the set and needs to be removed.

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::RenderLayer):
(WebCore::RenderLayer::~RenderLayer):
(WebCore::RenderLayer::calculateClipRects):

rendering/RenderLayer.h:

2:42 AM Changeset in webkit [196930] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196641 - Rollout r188659. This broke scrolling of iframes and overflow when
navigating back to a page in the page cache.

The fix was overly agressive and had no layout test. I will fix the original
issue a different way.

history/CachedFrame.cpp:

(WebCore::CachedFrame::CachedFrame):

page/FrameView.cpp:

(WebCore::FrameView::clearScrollableAreas): Deleted.

page/FrameView.h:

2:36 AM Changeset in webkit [196929] by Carlos Garcia Campos

4 edits
2 adds in releases/WebKitGTK/webkit-2.10

Merge r196640 - [GTK] No hover-horizontal scrolling available
https://bugs.webkit.org/show_bug.cgi?id=122859

Reviewed by Michael Catanzaro.

Source/WebCore:

This is a regression of WebKit2, because in WebKit1 we used native
widgets for frame scrollbars that handled this automatically. Now
we need to also check if the mouse is over frame scrollbars to
adjust the wheel event.

Test: platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll.html

page/EventHandler.cpp:

(WebCore::EventHandler::handleWheelEvent): Pass the adjusted wheel
event to platformCompleteWheelEvent().

page/gtk/EventHandlerGtk.cpp:

(WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
Check also frame scrollbars.

LayoutTests:

platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll-expected.html: Added.
platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll.html: Added.

2:35 AM Changeset in webkit [196928] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196631 - Mouse cursor doesn't change when entering scrollbars
https://bugs.webkit.org/show_bug.cgi?id=154243

Reviewed by Simon Fraser.

If the scrollbar is over or very close to text or a link, when
entering the scrollbar the cursor is not changed, keeping the beam
or hand cursor when using the scrollbar. Same happens for image
documents where the magnifier cursor is used and it remains when
entering the scrollbars. We should use pointer cursor always for
scrollbars.

page/EventHandler.cpp:

(WebCore::EventHandler::updateCursor): Request also to include
frame scrollbars in hit test result.
(WebCore::EventHandler::selectCursor): Use always pointer cursor
for scrollbars.

2:32 AM Changeset in webkit [196927] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196602 - Null-deref crash in DefaultAudioDestinationNode::suspend()
https://bugs.webkit.org/show_bug.cgi?id=154248

Reviewed by Alex Christensen.

Null-check scriptExecutionContext() before deref.

Modules/webaudio/DefaultAudioDestinationNode.cpp:

(WebCore::DefaultAudioDestinationNode::resume):
(WebCore::DefaultAudioDestinationNode::suspend):
(WebCore::DefaultAudioDestinationNode::close):

2:31 AM Changeset in webkit [196926] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore

Merge r196591 - [ARMv7] stress/op_rshift.js and stress/op_urshift.js are failing.
https://bugs.webkit.org/show_bug.cgi?id=151514

Reviewed by Filip Pizlo.

The issue turns out to be trivial: on ARMv7 (and traditional ARM too), arithmetic
shift right (ASR) and logical shift right (LSR) takes an immediate shift amount
from 1-32. See http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204j/Cjacbgca.html.
An immediate shift amount of 0 is interpreted as a shift of 32 bits.

Meanwhile, our macro assembler is expecting the immediate shift value to be
between 0-31. As a result, a shift amount of 0 is being wrongly encoded with 0
bits which means shift right by 32 bits.

The fix is to check if the shift amount is 0, and if so, emit a move. Else,
emit the right shift as usual.

This issue does not affect left shifts, as the immediate shift amount for left
shifts is between 0-31 as our macro assembler expects.

assembler/MacroAssemblerARM.h:

(JSC::MacroAssemblerARM::rshift32):
(JSC::MacroAssemblerARM::urshift32):
(JSC::MacroAssemblerARM::sub32):

assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::rshift32):
(JSC::MacroAssemblerARMv7::urshift32):

tests/stress/op_rshift.js:
tests/stress/op_urshift.js:
Un-skip these tests. They should always pass now.

2:29 AM Changeset in webkit [196925] by Carlos Garcia Campos

3 edits
1 add in releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore

Merge r196587 - Parser::parseVariableDeclarationList should null check the node before attempting to create a new CommaExpr
https://bugs.webkit.org/show_bug.cgi?id=154244
rdar://problem/24290670

Reviewed by Michael Saboff.

parser/ASTBuilder.h:

(JSC::ASTBuilder::appendToCommaExpr): Catch the bug sooner in debug.

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseVariableDeclarationList): Fix the bug.

tests/stress/for-let-comma.js: Added. This used to crash in debug and release.

2:22 AM Changeset in webkit [196924] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r196475 - [GTK] HTTP auth dialog incorrectly rendered with Accelerated Compositing enabled
https://bugs.webkit.org/show_bug.cgi?id=154159

Reviewed by Michael Catanzaro.

There are two problems here, first we are changing the cairo
operator when rendering the xcomposite window pixmap without a
proper save/restore, so it affects the drawing that happens after
that, and second problem is that we are not rendering the gray
background in AC mode because we are returning earlier.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewRenderAcceleratedCompositingResults):
(webkitWebViewBaseDraw):

2:21 AM Changeset in webkit [196923] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196469 - GCC buildfix in Source/WebCore/svg/SVGToOTFFontConversion.cpp
https://bugs.webkit.org/show_bug.cgi?id=154162

Reviewed by Andreas Kling.

svg/SVGToOTFFontConversion.cpp:

(WebCore::SVGToOTFFontConverter::finishAppendingKERNSubtable):

2:19 AM Changeset in webkit [196922] by Carlos Garcia Campos

6 edits in releases/WebKitGTK/webkit-2.10/Source/bmalloc

Merge r196421, r196424, r196536: bmalloc: large aligned allocations will put 1 or 2 free object on free list without merging with free neighbors
https://bugs.webkit.org/show_bug.cgi?id=154091

Reviewed by Geoffrey Garen.

If we split off any unused free object in the aligned version of Heap::allocateLarge(), we merge them with
free neighbors before putting them back on the free list. Added helpers to verify that when we
add LargeObjects to the free list their neighbors are allocated.

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateLarge): Deleted private helper version and rolled it into the two the
two public versions of allocateLarge().

bmalloc/Heap.h:
bmalloc/LargeObject.h:

(bmalloc::LargeObject::prevIsAllocated): New helper.
(bmalloc::LargeObject::nextIsAllocated): New helper.
(bmalloc::LargeObject::merge): Check that the merge object has allocated neighbors.

Unreviewed build fix after r196421.

Removed BASSERTs that are firing to eliminate Debug build crashes. I'll debug locally and
enable or alter after the issue is understood.

bmalloc/LargeObject.h:

(bmalloc::LargeObject::merge): Removed BASSERTs that are firing.

BASSERTs added in r196421 are causing debug test failures
https://bugs.webkit.org/show_bug.cgi?id=154113

Reviewed by Geoffrey Garen.

In VMHeap::deallocateLargeObject(), we drop the lock to deallocate the physical pages.
If the scavenger thread is running at the same time a synchronous call to scavenge()
comes in, we could call VMHeap::deallocateLargeObject() for an adjacent object while the
lock in the other thread is dropped. We fix this by checking for adjacent objects we
can merge with and loop if we have one.

bmalloc/FreeList.h:

(bmalloc::FreeList::push): Added BASSERT to catch adding unmerged free objects

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateLarge): Changed to use nextCanMerge().

bmalloc/LargeObject.h:

(bmalloc::LargeObject::prevCanMerge): Repurposed prevIsAllocated.
(bmalloc::LargeObject::nextCanMerge): Repurposed nextIsAllocated.
(bmalloc::LargeObject::prevIsAllocated): Deleted.
(bmalloc::LargeObject::nextIsAllocated): Deleted.

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateLargeObject): Moved adding the extra object back to the free list
to after we set the object we'll return as being allocated.
(bmalloc::VMHeap::deallocateLargeObject):

2:12 AM Changeset in webkit [196921] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196364 - [GTK] Toggle buttons are blurry with GTK+ 3.19
https://bugs.webkit.org/show_bug.cgi?id=154007

Reviewed by Michael Catanzaro.

Use min-width/min-height style properties when GTK+ >= 3.19.7 to
get the size of toggle buttons.

rendering/RenderThemeGtk.cpp:

(WebCore::setToggleSize):
(WebCore::paintToggle):

2:09 AM Changeset in webkit [196920] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore

Merge r196337 - Don't crash if we fail to parse a builtin
https://bugs.webkit.org/show_bug.cgi?id=154047
rdar://problem/24300617

Reviewed by Mark Lam.

Crashing probably seemed like a good idea at the time, but we could get here in case of a
near stack overflow, so that the parser bails because of recursion.

parser/Parser.h:

(JSC::parse):

2:03 AM Changeset in webkit [196919] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r196307 - possible buffer overrun in Connection::processMessage of Source/WebKit2/Platform/IPC/unix/ConnectionUnix.cpp
https://bugs.webkit.org/show_bug.cgi?id=153637

Patch by Fujii Hironori <Hironori.Fujii@jp.sony.com> on 2016-02-09
Reviewed by Carlos Garcia Campos.

Platform/IPC/unix/ConnectionUnix.cpp:

(IPC::Connection::processMessage): Fix invalid arguments of memmove.

1:31 AM Changeset in webkit [196918] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r196264 - Infinite loop when processing mouse events synchronously
https://bugs.webkit.org/show_bug.cgi?id=153995

Reviewed by Darin Adler.

This happened with WTR in the GTK+ port after landing patch in bug
to be synchronous. When a drag and drop operation is in progress,
the web process ignores mouse move events and replies with
DidReceiveEvent signal. The DidReceiveEvent message handler in
WebPageProxy checks if we have a m_nextMouseMoveEvent and handles
it, but when all this happens synchronously the
m_nextMouseMoveEvent is the current one because we haven't
returned yet from handleMouseEvent(). We need to invalidate the
m_nextMouseMoveEvent before calling handleMouseEvent().

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didReceiveEvent):

1:30 AM Changeset in webkit [196917] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.10/Source/WTF

Merge r196259 - Make sure that locking code that relies on module boundaries for compiler fences uses NEVER_INLINE
https://bugs.webkit.org/show_bug.cgi?id=153972

Reviewed by Andreas Kling.

When this code was written, we assumed that module boundaries were compiler fences. That might
not be the case if we ever do LTO.

wtf/Lock.cpp:

(WTF::LockBase::lockSlow):
(WTF::LockBase::unlockSlow):

wtf/ParkingLot.cpp:

(WTF::ParkingLot::parkConditionally):
(WTF::ParkingLot::unparkOne):
(WTF::ParkingLot::unparkAll):
(WTF::ParkingLot::forEach):

wtf/WordLock.cpp:

(WTF::WordLock::lockSlow):
(WTF::WordLock::unlockSlow):

1:29 AM Changeset in webkit [196916] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebKit2

Merge r196257 - [GTK] Fix crash when creating webview with g_object_new
https://bugs.webkit.org/show_bug.cgi?id=153989

Patch by Danilo Cesar Lemes de Paula <danilo.cesar@collabora.co.uk> on 2016-02-08
Reviewed by Carlos Garcia Campos.

g_object_new(WEBKIT_TYPE_WEB_VIEW, NULL) crashes webkit
as _WebKitWebViewBasePrivate constructor requires a mainloop, but
webkit is only initialized when a context is created (which
doesn't happen with a direct call to g_object_new).

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkit_web_view_base_class_init):

1:25 AM Changeset in webkit [196915] by Carlos Garcia Campos

5 edits in releases/WebKitGTK/webkit-2.10/Source

Merge r196253 - [GTK] WebKitWebView should send crossing events to the WebProcess
https://bugs.webkit.org/show_bug.cgi?id=153740

Reviewed by Michael Catanzaro.

Source/WebCore:

Update the target element under the mouse also when only updating
scrollbars, so that if the mouse enters the page when the window
is not active, the scroll animator is notified that the mouse
entered the scrollable area.

page/EventHandler.cpp:

(WebCore::EventHandler::handleMouseMoveEvent): Call
updateMouseEventTargetNode() before early returning in case of
only updating scrollbars.

Source/WebKit2:

We don't currently handle crossing events in the web view
(enter/leave). That's why if you hover a scrollbar and leave the
window, the scrollbar is still rendered as hovered.

Shared/gtk/WebEventFactory.cpp:

(WebKit::buttonForEvent): Handle the case of GDK_ENTER_NOTIFY and
GDK_LEAVE_NOTIFY events.
(WebKit::WebEventFactory::createWebMouseEvent): Ditto.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewBaseRealize): Add GDK_ENTER_NOTIFY_MASK and
GDK_LEAVE_NOTIFY_MASK flags to the web view event mask.
(webkitWebViewBaseCrossingNotifyEvent): Handle enter/leave notify
events by generating a mouse move event, ensuring the double to
int conversion will not cause any problem.
(webkit_web_view_base_class_init): Add an implementation for
enter_notify_event and leave_notify_event.

1:19 AM Changeset in webkit [196914] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196172 - [GTK] Scrollbars incorrectly rendered with older versions of GTK+
https://bugs.webkit.org/show_bug.cgi?id=153861

Reviewed by Michael Catanzaro.

The theme doesn't really know it's a scrollbar. Older versions of
GTK+ require to explicitly add the scrollbar style class to the
child GtkStyleContext.

platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::createChildStyleContext):

1:18 AM Changeset in webkit [196913] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196171 - [GTK] Scrollbars not correctly rendered in non GNOME environments
https://bugs.webkit.org/show_bug.cgi?id=153860

Reviewed by Michael Catanzaro.

I noticed this in a matchbox environment, where there's no
gnome-setting-daemon running. The problem is only with the
scrollbars, because we initialize the GtkSettings in
RenderThemeGtk and notify the ScrollbarTheme when it changes, but
ScrollbarTheme is created before RenderThemeGtk so we initialize
the theme properties before the GtkSettings have been
initialized. We can just let the ScrollbarTheme monitor the
theme itself instead of relying on being notified by the WebCore
layer.

platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::themeChangedCallback):
(WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk):

rendering/RenderThemeGtk.cpp:

(WebCore::gtkStyleChangedCallback): Deleted.

1:12 AM Changeset in webkit [196912] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.10

Merge r196112 - Do not show context menu when right clicking on a scrollbar
https://bugs.webkit.org/show_bug.cgi?id=153493

Reviewed by Michael Catanzaro.

Source/WebCore:

Scrollbars don't currently handle right clicks, but we are showing
the context menu when they are right clicked. This is not desired
at least in GTK+ and I've checked that it isn't consistent with
other applications in Mac either.

Test: fast/events/contextmenu-on-scrollbars.html

page/EventHandler.cpp:

(WebCore::EventHandler::sendContextMenuEvent):

LayoutTests:

Add a test to check that context menu event is not sent when right
clicking on a scrollbar.

fast/events/contextmenu-on-scrollbars-expected.txt: Added.
fast/events/contextmenu-on-scrollbars.html: Added.

1:09 AM Changeset in webkit [196911] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.10

Merge r196061 - [GTK] Layout Test http/tests/appcache/different-https-origin-resource-main.html is failing
https://bugs.webkit.org/show_bug.cgi?id=145253

Reviewed by Michael Catanzaro.

Source/WebCore:

The problem is that when the load is cancelled while the
connection is still being established,
SoupMessage::notify::tls-errors is emitted and the handler calls
ResourceHandleClient::didFail() which can delete the ResourceHandle.

platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::tlsErrorsChangedCallback): Protect the ResourceHandle
for the scope of the callback because
ResourceHandleClient::didFail() could delete the object.

LayoutTests:

Update test expectation.

platform/gtk/TestExpectations:

1:07 AM Changeset in webkit [196910] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196055 - [TexMap] Don't use RELEASE_ASSERT in TextureMapperLayer::computeTransformsRecursive()
https://bugs.webkit.org/show_bug.cgi?id=153822

Reviewed by Carlos Garcia Campos.

platform/graphics/texmap/TextureMapperLayer.cpp:

(WebCore::TextureMapperLayer::computeTransformsRecursive):
Use ASSERT to check that the m_children members are indeed children
of the current layer, RELEASE_ASSERT probably slipped in unnoticed
at some point.

1:07 AM Changeset in webkit [196909] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196054 - PlatformPathCairo: Lazily allocate the path surface
https://bugs.webkit.org/show_bug.cgi?id=153821

Reviewed by Carlos Garcia Campos.

Move the static variable that holds the Cairo surface into
the pathSurface() function (previously getPathSurface). This
way the surface will only be allocated once the function is
called for the first time from the CairoPath surface.

No change in functionality, just a cleanup.

platform/graphics/cairo/PlatformPathCairo.cpp:

(WebCore::pathSurface):
(WebCore::CairoPath::CairoPath):
(WebCore::getPathSurface): Deleted.

1:06 AM Changeset in webkit [196908] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.10

Merge r196052 - ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result)
https://bugs.webkit.org/show_bug.cgi?id=153576

Patch by Fujii Hironori <Hironori.Fujii@jp.sony.com> on 2016-02-02
Reviewed by Darin Adler.

Source/WebCore:

Tests: fast/block/geometry-map-assertion-with-rounding-negative-half.html

The results of roundedIntPoint of FloatPoint and LayoutPoint may be different
because of the uniqueness of LayoutUnit::round introduced by this bug
<https://bugs.webkit.org/show_bug.cgi?id=107208>.
Should convert a FloatPoint to a LayoutPoint before rounding.

rendering/RenderGeometryMap.cpp:

(WebCore::RenderGeometryMap::mapToContainer):

LayoutTests:

fast/block/geometry-map-assertion-with-rounding-negative-half-expected.txt: Added.
fast/block/geometry-map-assertion-with-rounding-negative-half.html: Added.

1:04 AM Changeset in webkit [196907] by Carlos Garcia Campos

2 edits
1 add in releases/WebKitGTK/webkit-2.10/Source/JavaScriptCore

Merge r196051 - JSSymbolTableObject::deleteProperty() crashes deleting Symbols
https://bugs.webkit.org/show_bug.cgi?id=153816

Patch by Caitlin Potter <caitp@igalia.com> on 2016-02-02
Reviewed by Darin Adler.

Changes JSSymbolTableObject::deleteProperty() to check if its
symbolTable() contains the property's uid() rather than publicName().
This ensures that it will not crash in the case of Symbols.

runtime/JSSymbolTableObject.cpp:

(JSC::JSSymbolTableObject::deleteProperty):

tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js:

(testGlobalProxy):

tests/stress/regress-153816.js: Added.

(deleteSymbolFromJSSymbolTableObject):

1:01 AM Changeset in webkit [196906] by Manuel Rego Casasnovas

5 edits in trunk

[css-grid] Swap columns and rows in grid shorthand
https://bugs.webkit.org/show_bug.cgi?id=154449

Reviewed by Darin Adler.

The spec was modified past December to change the order of
columns and rows in the grid shorthand:
https://github.com/w3c/csswg-drafts/commit/7454c7c8c5857b61bbbe2ee5f07803c264bf37e4

Updated the parsing and modified the tests to follow the new syntax.

Source/WebCore:

css/CSSParser.cpp:

(WebCore::CSSParser::parseGridShorthand):

LayoutTests:

fast/css-grid-layout/grid-shorthand-get-set-expected.txt:
fast/css-grid-layout/grid-shorthand-get-set.html:

1:00 AM Changeset in webkit [196905] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r196039 - WEBGL_debug_shaders should be disabled for OpenGLES backend also
https://bugs.webkit.org/show_bug.cgi?id=153788

Reviewed by Darin Adler.

WEBGL_debug_shaders extension is disabled for OpenGL backed platform
because the implementation is not fully compliant to the spec yet.
Because this is not an OpenGL-specific problem, WEBGL_debug_shaders extension
should be disabled for OpenGLES backed platforms also.

No new tests, already covered by existing tests.

platform/graphics/opengl/Extensions3DOpenGL.cpp:

(WebCore::Extensions3DOpenGL::supportsExtension): Deleted.

platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:

(WebCore::Extensions3DOpenGLCommon::supports):

12:55 AM Changeset in webkit [196904] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r195965 - REGRESSION(r195770): Use-after-free in ResourceLoaderOptions::cachingPolicy
https://bugs.webkit.org/show_bug.cgi?id=153727
<rdar://problem/24429886>

Reviewed by Chris Dumez.

The this object may be freed after calling deleteIfPossible(). Make the early-return-if-
deleted more explicit, and only check allowsCaching() after the deleteIfPossible() return
value check.

loader/cache/CachedResource.cpp:

(WebCore::CachedResource::removeClient):

12:47 AM Changeset in webkit [196903] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.10

Merge r195837 - [WebGL] Check vertex array bounds before permitting a glDrawArrays to execute
https://bugs.webkit.org/show_bug.cgi?id=153643
<rdar://problem/23424456>

Reviewed by Dean Jackson.

Tested by fast/canvas/webgl/webgl-drawarrays-crash.html.

html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::validateDrawArrays): Make sure that we have at
least one buffer bound to a program if a drawArray call with a non-zero range of
requested data is being made.
(WebCore::WebGLRenderingContextBase::validateDrawElements): Drive-by formatting fix.

LayoutTests:
Test to check for stack recursion when indexed propertyNames defined using Object.defineProperty are deleted.
https://bugs.webkit.org/show_bug.cgi?id=149179
<rdar://problem/22708019>.

Patch by Pranjal Jumde <pjumde@apple.com> on 2015-12-22
Reviewed by Dean Jackson.

storage/domstorage/localstorage/delete-defineproperty-removal-expected.txt: Added.
storage/domstorage/localstorage/delete-defineproperty-removal.html: Added.

12:43 AM Changeset in webkit [196902] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.10

Merge r195809 - [GStreamer] built-in media player doesn't update
https://bugs.webkit.org/show_bug.cgi?id=151816

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

The timeline of audio controls in media document is not properly updated since it is assumed
that the controls are hidden as soon as playing. However, such full page audio always has
opacity : 1 declared by video:-webkit-full-page-media::-webkit-media-controls-panel.no-video.
i.e. it is not actually hidden. We can fix this by simply returning false for no-video media
in controlsAreHidden();

Test: media/audio-controls-timeline-in-media-document.html

Modules/mediacontrols/mediaControlsBase.js:

(Controller.prototype.controlsAreAlwaysVisible):
(Controller.prototype.controlsAreHidden):

LayoutTests:

media/audio-controls-timeline-in-media-document-expected.txt: Added.
media/audio-controls-timeline-in-media-document.html: Added.

12:35 AM Changeset in webkit [196901] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r195705 - AX: Crash in AccessibilityTableColumn::headerObject
https://bugs.webkit.org/show_bug.cgi?id=153553
<rdar://problem/23196278>

Reviewed by Chris Fleizach.

Webkit was crashing sometimes when we asked for column headers of a table.
The columns vector of the table was reset during the iteration when we
were asking for the headerObject of each column. The column's addChildren()
function calls elementRect() for each child cell and that sometimes causes
the parent table to reset its children.
Fixed it by caching the columns vector and moving out the elementRect() logic
from AccessibilityTalbeColumn::addChildren().

accessibility/AccessibilityTable.cpp:

(WebCore::AccessibilityTable::columnHeaders):
(WebCore::AccessibilityTable::rowHeaders):

accessibility/AccessibilityTableColumn.cpp:

(WebCore::AccessibilityTableColumn::elementRect):
(WebCore::AccessibilityTableColumn::headerObject):
(WebCore::AccessibilityTableColumn::addChildren):

accessibility/AccessibilityTableColumn.h:

12:31 AM Changeset in webkit [196900] by youenn.fablet@crf.canon.fr

21 edits
1 delete in trunk

Binding generator should support key value iterable
https://bugs.webkit.org/show_bug.cgi?id=154413

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

web-platform-tests/fetch/api/headers/headers-basic-expected.txt:
web-platform-tests/fetch/api/headers/headers-basic.html:

Source/WebCore:

Covered by added layout and binding tests.

iterable<key, value> in a IDL file will trigger the generation of entries, keys, values, [Symbol.iterator] and forEach methods to the prototype.
Updated FetchHeaders and FontFaceSet to use it.

IDLParser.pm parses the iterable<> and adds an iterable field in the interface containing the iterable information and objects for the five operations.
IDLParser.pm is cleaned up a bit to remove previous Iterator support, which does not seem to be supported.

CodeGeneratorJS.pm is updated to generate the code for the five operations, using JSKeyValueIterator. Set iterators are not yet supported.
Moved definition of Iterator Key and Value Type to binding generated JSXX class based on iterable<> declaration in the IDL.

Added binding test and Fetch Headers tests.

CMakeLists.txt:
Modules/fetch/FetchHeaders.idl:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSBindingsAllInOne.cpp:
bindings/js/JSFetchHeadersCustom.cpp: Removed.
bindings/js/JSFontFaceSetCustom.cpp:

(WebCore::JSFontFaceSet::ready): Removed iterable custom methods.

bindings/js/JSKeyValueIterator.h:

(WebCore::createKeyValueIterator):
(WebCore::keyValueIteratorForEach):

bindings/scripts/CodeGeneratorJS.pm:

(GetFunctionName):
(PrototypeFunctionCount):
(PrototypePropertyCount):
(GeneratePropertiesHashTable):
(GenerateImplementation):
(GenerateImplementationFunctionCall):
(GenerateImplementationIterableFunctions):

bindings/scripts/IDLParser.pm:

(parseOperationOrIterator):
(parseOperationOrIteratorRest):
(parseIterableRest):
(parseOptionalIterableInterface):
(applyMemberList):
(parseSpecial): Deleted.

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::JSTestObjPrototype::finishCreation):
(WebCore::jsTestObjPrototypeFunctionSymbolIterator):
(WebCore::jsTestObjPrototypeFunctionEntries):
(WebCore::jsTestObjPrototypeFunctionKeys):
(WebCore::jsTestObjPrototypeFunctionValues):
(WebCore::jsTestObjPrototypeFunctionForEach):

bindings/scripts/test/TestObj.idl:
css/FontFaceSet.idl:

12:14 AM Changeset in webkit [196899] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.10

Merge r195652 - fast/history/page-cache-webdatabase-no-transaction-db.html flakily crashes
https://bugs.webkit.org/show_bug.cgi?id=153525

Reviewed by Andreas Kling.

Source/WebCore:

The test was crashing because DatabaseThread::hasPendingDatabaseActivity()
was accessing m_openDatabaseSet from the main thread without any locking
mechanism. This is an issue because m_openDatabaseSet is altered by the
database thread.

No new tests, already covered by fast/history/page-cache-webdatabase-no-transaction-db.html.

Modules/webdatabase/DatabaseThread.cpp:

(WebCore::DatabaseThread::databaseThread):
(WebCore::DatabaseThread::recordDatabaseOpen):
(WebCore::DatabaseThread::recordDatabaseClosed):
(WebCore::DatabaseThread::hasPendingDatabaseActivity):

Modules/webdatabase/DatabaseThread.h:

LayoutTests:

Unskip fast/history/page-cache-webdatabase-no-transaction-db.html now
that it no longer crashes.

TestExpectations:

12:06 AM Changeset in webkit [196898] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.10/Source/WebCore

Merge r195596 - Do not convert GlyphBufferAdvance to FloatSize
https://bugs.webkit.org/show_bug.cgi?id=153429

GlyphBufferAdvance is not necessaryly convertible to FloatSize.
Also, this code was doing extra work by transforming height value.

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-01-26
Reviewed by Antti Koivisto.

No new tests needed.

rendering/svg/SVGTextRunRenderingContext.cpp:

(WebCore::SVGGlyphToPathTranslator::extents):

12:02 AM Changeset in webkit [196897] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.10

Merge r195540 - Media "ended" event incorrectly fires when currentTime is set
https://bugs.webkit.org/show_bug.cgi?id=150348
<rdar://problem/24247974>

Reviewed by Jer Noble.

Source/WebCore:

Test: media/media-ended-fired-once.html

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::invalidateCachedTime): Always mark m_cachedTime as invalid.

LayoutTests:

media/media-ended-fired-once-expected.txt: Added.
media/media-ended-fired-once.html: Added.

Feb 21, 2016:

11:29 PM Changeset in webkit [196896] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

CodeBlock always visits its unlinked code twice
https://bugs.webkit.org/show_bug.cgi?id=154494

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-21
Reviewed by Saam Barati.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::visitChildren):
The unlinked code is always visited in stronglyVisitStrongReferences.

10:30 PM Changeset in webkit [196895] by Chris Dumez

2 edits in trunk/LayoutTests/imported/w3c

Unreviewed, rebaseline html/dom/interfaces.html.

web-platform-tests/html/dom/interfaces-expected.txt:

10:28 PM Changeset in webkit [196894] by Chris Dumez

19 edits in trunk

HTMLScriptElement.crossOrigin / HTMLImageElement.crossOrigin should only return known values
https://bugs.webkit.org/show_bug.cgi?id=154502

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:
web-platform-tests/html/dom/reflection-embedded-expected.txt:
web-platform-tests/html/dom/reflection-misc-expected.txt:

Source/WebCore:

HTMLScriptElement.crossOrigin / HTMLImageElement.crossOrigin should only
return known values and should be nullable as per the specification:

This aligns our behavior with the HTML specification and Firefox.

No new tests, already covered by existing tests.

bindings/scripts/CodeGeneratorJS.pm:

Add support for nullable DOMString attributes. If such attribute is
marked as nullable:

A null string is passed to the implementation if the setter is called with null/undefined.
null is returned to the Javascript if the getter implementation returns a null string.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:
bindings/scripts/test/TestObj.idl:

Add test coverage for nullable DOMString attributes
and rebaseline bindings tests.

html/HTMLImageElement.cpp:
html/HTMLImageElement.h:
html/HTMLImageElement.idl:
html/HTMLScriptElement.cpp:
html/HTMLScriptElement.h:
html/HTMLScriptElement.idl:
html/parser/HTMLParserIdioms.cpp:
html/parser/HTMLParserIdioms.h:

9:52 PM Changeset in webkit [196893] by Chris Dumez

14 edits
1 add
6 deletes in trunk

Make HTMLSelectElement.size behave as per the specification
https://bugs.webkit.org/show_bug.cgi?id=154504

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/reflection-forms-expected.txt:
web-platform-tests/html/dom/reflection-tabular-expected.txt:

Source/WebCore:

Make HTMLSelectElement.size behave as per the specification:

In particular, it should be unsigned and be in the range [0; 2147483647].

Also update several unsigned long attributes in our HTML implementation to use
parseHTMLNonNegativeInteger() to parse unsigned integers as per the HTML
specification, instead of calling String::toUint().

No new tests, already covered by existing tests.

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::parseAttribute):
(WebCore::HTMLInputElement::size):
(WebCore::HTMLInputElement::setSize):

html/HTMLInputElement.h:
html/HTMLSelectElement.cpp:

(WebCore::HTMLSelectElement::parseAttribute):
(WebCore::HTMLSelectElement::setSize):
(WebCore::HTMLSelectElement::namedItem): Deleted.
(WebCore::HTMLSelectElement::item): Deleted.

html/HTMLSelectElement.h:

(WebCore::HTMLSelectElement::size):

html/HTMLSelectElement.idl:
html/HTMLTableColElement.cpp:

(WebCore::HTMLTableColElement::parseAttribute):
(WebCore::HTMLTableColElement::setSpan):

html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::parseAttribute):
(WebCore::HTMLTextAreaElement::setCols):
(WebCore::HTMLTextAreaElement::setRows):

html/parser/HTMLParserIdioms.h:

(WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
(WebCore::limitToOnlyHTMLNonNegative):

LayoutTests:

Update test that was covering the case of an HTMLSelectElement with an
invalid size attribute. The test was expecting the bad "size" attribute
value to get corrected so that the select element looks like a menu list.
This workaround was added back in 2007 to workaround a bug on
www.chainreaction.com (rdar://problem/4697438). This patch drops the
workaround in HTMLSelectElement::parseAttribute() because:

This is not standard behavior as per the HTML specification
This behavior does not match Firefox either
The workaround is no longer needed for www.chainreaction.com.

fast/forms/select-size-expected.html: Added.
fast/forms/select-size.html:
platform/efl/fast/forms/select-size-expected.txt: Removed.
platform/gtk/fast/forms/select-size-expected.txt: Removed.
platform/ios-simulator/fast/forms/select-size-expected.txt: Removed.
platform/mac/fast/forms/select-size-expected.png: Removed.
platform/mac/fast/forms/select-size-expected.txt: Removed.
platform/win/fast/forms/select-size-expected.txt: Removed.

9:26 PM Changeset in webkit [196892] by dbates@webkit.org

4 edits in trunk

CSP: Enable form-action directive by default
https://bugs.webkit.org/show_bug.cgi?id=154520
<rdar://problem/24762029>

Reviewed by Sam Weinig.

Source/WebCore:

page/csp/ContentSecurityPolicyDirectiveList.cpp:

LayoutTests:

Mark form-action tests as Pass so that we run them.

TestExpectations:

8:49 PM Changeset in webkit [196891] by BJ Burg

9 edits
2 moves
2 adds in trunk/Source

Web Inspector: add 'Automation' protocol domain and generate its backend classes separately in WebKit2
https://bugs.webkit.org/show_bug.cgi?id=154509
<rdar://problem/24759098>

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

Add a new 'WebKit' framework, which is used to generate protocol code
in WebKit2.

Add --backend and --frontend flags to the main generator script.
These allow a framework to trigger two different sets of generators
so they can be separately generated and compiled.

inspector/scripts/codegen/models.py:

(Framework.fromString):
(Frameworks): Add new framework.

inspector/scripts/generate-inspector-protocol-bindings.py:

If neither --backend or --frontend is specified, assume both are wanted.
This matches the behavior for JavaScriptCore and WebInspector frameworks.

(generate_from_specification):
Generate C++ files for the backend and Objective-C files for the frontend.

Source/WebKit2:

Add build system logic to generate JSON-RPC protocol bindings
for the 'Automation' domain using the inspector code generators.

Move automation-related files that are not API or SPI into their
own directory.

Configurations/BaseTarget.xcconfig: Tell where JavaScriptCore's

private headers are, since that's where the code generators live.

CMakeLists.txt: Look in UIProcess/Automation directory.
PlatformMac.cmake:
DerivedSources.make: Generate protocol bindings for a single domain.

The names of the generated files will be improved in a follow-up patch
so that they do not clash with generated files in JavaScriptCore.

UIProcess/Automation/Automation.json: Added.
UIProcess/Automation/WebAutomationSession.cpp: Renamed from Source/WebKit2/UIProcess/WebAutomationSession.cpp.

(WebKit::WebAutomationSession::WebAutomationSession):
(WebKit::WebAutomationSession::~WebAutomationSession):
Set up a backend dispatcher and frontend router. They will be used later.

(WebKit::WebAutomationSession::dispatchMessageFromRemote):
Forward messages from the remote to the backend dispatcher. When
an agent / command handler is registered, it will receive the message.

(WebKit::WebAutomationSession::connect):
(WebKit::WebAutomationSession::disconnect):
Connenct and disconnect the frontend router to the remote channel.

UIProcess/Automation/WebAutomationSession.h: Renamed from Source/WebKit2/UIProcess/WebAutomationSession.h.
WebKit2.xcodeproj/project.pbxproj: Add and move files.

7:28 PM Changeset in webkit [196890] by Chris Dumez

24 edits
3 adds in trunk

Add username / password attributes to HTMLAnchorElement / HTMLAreaElement
https://bugs.webkit.org/show_bug.cgi?id=154519

Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Add username / password attributes to HTMLAnchorElement / HTMLAreaElement as per:
https://html.spec.whatwg.org/#htmlhyperlinkelementutils

Firefox and Chrome already implement these.

Also stop treating null as the empty string for the HTMLHyperlinkElementUtils
attributes. This behavior does not match the specification or other browsers
(tested Firefox and Chrome).

Test: fast/dom/HTMLAnchorElement/set-href-attribute-user-pass.html

CMakeLists.txt:
DerivedSources.make:
WebCore.xcodeproj/project.pbxproj:
html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::username):
(WebCore::HTMLAnchorElement::setUsername):
(WebCore::HTMLAnchorElement::password):
(WebCore::HTMLAnchorElement::setPassword):

html/HTMLAnchorElement.h:
html/HTMLAnchorElement.idl:
html/HTMLAreaElement.idl:
html/HTMLHyperlinkElementUtils.idl: Added.

LayoutTests:

fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-hash.js:
fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-host.js:
fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-hostname.js:
fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-pathname.js:
fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-protocol.js:
fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-search.js:
fast/dom/HTMLAnchorElement/set-href-attribute-hash-expected.txt:
fast/dom/HTMLAnchorElement/set-href-attribute-host-expected.txt:
fast/dom/HTMLAnchorElement/set-href-attribute-hostname-expected.txt:
fast/dom/HTMLAnchorElement/set-href-attribute-pathname-expected.txt:
fast/dom/HTMLAnchorElement/set-href-attribute-protocol-expected.txt:
fast/dom/HTMLAnchorElement/set-href-attribute-search-expected.txt:

Update / rebaseline tests now that we no longer treat null as the empty string.

fast/dom/HTMLAnchorElement/set-href-attribute-user-pass-expected.txt: Added.
fast/dom/HTMLAnchorElement/set-href-attribute-user-pass.html: Added.

Add test coverage for setting the username / password attributes.

js/dom/dom-static-property-for-in-iteration-expected.txt:

Rebaseline now that HTMLAnchorElement / HTMLAreaElement have 2 additional
attributes: username and password.

7:27 PM Changeset in webkit [196889] by Chris Dumez

6 edits
2 adds in trunk

iframe/frame/object.contentDocument should be on the prototype
https://bugs.webkit.org/show_bug.cgi?id=154409

Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Test: http/tests/security/cross-origin-iframe-contentDocument.html

bindings/scripts/CodeGeneratorJS.pm:

(AttributeShouldBeOnInstance): Deleted.

LayoutTests:

Add test coverage for trying to access iframe.contentDocument cross origin
to make sure it still fails and logs a security error.

http/tests/security/cross-origin-iframe-contentDocument-expected.txt: Added.
http/tests/security/cross-origin-iframe-contentDocument.html: Added.

6:33 PM Changeset in webkit [196888] by Darin Adler

15 edits in trunk/Source

Refactor LazyEventListener creation to separate Element and Document cases
https://bugs.webkit.org/show_bug.cgi?id=154231

Reviewed by Andreas Kling.

Source/WebCore:

bindings/js/JSLazyEventListener.cpp:

(WebCore::JSLazyEventListener::create): Added. Newly factored to separate
Element, Document, and DOMWindow with overloading.
(WebCore::JSLazyEventListener::createForNode): Deleted.
(WebCore::JSLazyEventListener::createForDOMWindow): Deleted.

bindings/js/JSLazyEventListener.h: Replaced the separate createForNode

and createForDOMWindow functions with a single overloaded function create,
which takes an Element, Document, or DOMWindow. Also changed indentation
to match the style guide.

dom/Attr.h: Added newly needed forward class declaration.

dom/ContainerNode.cpp:

(WebCore::ContainerNode::setAttributeEventListener): Deleted.

dom/ContainerNode.h: Deleted setAttributeEventListener override; it's now

done separately by Element and Document.

dom/Document.cpp:

(WebCore::Document::setAttributeEventListener): Added. Makes the lazy event
listener and calls through to the base class's setAttributeEventListener.
(WebCore::Document::setWindowAttributeEventListener): Updated to call just
create instead of createForDOMWindow.

dom/Document.h: Removed some unneeded forward declarations. Added the

overload for setAttributeEventListener. Removed a no longer useful comment.

dom/Element.cpp:

(WebCore::Element::setAttributeEventListener): Added. Makes the lazy event
listener and calls through to the base class's setAttributeEventListener.

dom/Element.h: Removed some unneeded forward declarations. Added the

overload for setAttributeEventListener.

dom/Node.h: Removed many unneeded forward declarations.

dom/NodeRareData.h: Added one forward declaration.

editing/Editor.h: Added one forward declaration.

Source/WebKit/win:

WebView.h: Forward declare KeyboardEvent.

5:55 PM Changeset in webkit [196887] by Sukolsak Sakshuwong

8 edits in trunk/Source/JavaScriptCore

Improvements to Intl code
https://bugs.webkit.org/show_bug.cgi?id=154486

Reviewed by Darin Adler.

This patch does several things:

Use std::unique_ptr to store ICU objects.
Pass Vector::size() to ICU functions that take a buffer size instead of Vector::capacity().
If U_SUCCESS(status) is true, it means there is no error, but there could be warnings. ICU functions ignore warnings. So, there is no need to reset status to U_ZERO_ERROR.
Remove the initialization of the String instance variables of IntlDateTimeFormat. These values are never read and cause unnecessary memory allocation.
Fix coding style.
Some small optimization.

runtime/IntlCollator.cpp:

(JSC::IntlCollator::UCollatorDeleter::operator()):
(JSC::IntlCollator::createCollator):
(JSC::IntlCollator::compareStrings):
(JSC::IntlCollator::~IntlCollator): Deleted.

runtime/IntlCollator.h:
runtime/IntlDateTimeFormat.cpp:

(JSC::IntlDateTimeFormat::UDateFormatDeleter::operator()):
(JSC::defaultTimeZone):
(JSC::canonicalizeTimeZoneName):
(JSC::toDateTimeOptionsAnyDate):
(JSC::IntlDateTimeFormat::initializeDateTimeFormat):
(JSC::IntlDateTimeFormat::weekdayString):
(JSC::IntlDateTimeFormat::format):
(JSC::IntlDateTimeFormat::~IntlDateTimeFormat): Deleted.
(JSC::localeData): Deleted.

runtime/IntlDateTimeFormat.h:
runtime/IntlDateTimeFormatConstructor.cpp:
runtime/IntlNumberFormatConstructor.cpp:
runtime/IntlObject.cpp:

(JSC::numberingSystemsForLocale):

5:45 PM Changeset in webkit [196886] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

Remove arrowfunction test cases that rely on arguments variable in jsc
https://bugs.webkit.org/show_bug.cgi?id=154517

Patch by Skachkov Oleksandr <gskachkov@gmail.com> on 2016-02-21
Reviewed by Yusuke Suzuki.

Allow to jsc has the same behavior in javascript as browser has

tests/stress/arrowfunction-lexical-bind-arguments-non-strict-1.js:
tests/stress/arrowfunction-lexical-bind-arguments-strict.js:

5:30 PM Changeset in webkit [196885] by dbates@webkit.org

1 edit
3 adds in trunk/LayoutTests

CSP: sandbox directive should be ignored when contained in a policy defined via a meta element
https://bugs.webkit.org/show_bug.cgi?id=154299
<rdar://problem/24680433>

Add iOS Simulator-specific expected result for test http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe.html.

platform/ios-simulator/http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe-expected.txt: Added.

5:29 PM Changeset in webkit [196884] by Ryan Haddad

1 edit
1 add in trunk/LayoutTests

Adding ios-simulator baseline for js/number-toLocaleString.html
https://bugs.webkit.org/show_bug.cgi?id=154524

Unreviewed test gardening.

platform/ios-simulator/js/number-toLocaleString-expected.txt: Added.

5:27 PM Changeset in webkit [196883] by Chris Dumez

8 edits in trunk/LayoutTests/imported/w3c

Re-sync W3C HTML/DOM web-platform-tests
https://bugs.webkit.org/show_bug.cgi?id=154513

Reviewed by Darin Adler.

Re-sync W3C HTML/DOM web-platform-tests after:

web-platform-tests/html/dom/elements-embedded.js:
web-platform-tests/html/dom/elements-misc.js:
web-platform-tests/html/dom/interfaces.html:
web-platform-tests/html/dom/reflection-embedded-expected.txt:
web-platform-tests/html/dom/reflection-misc-expected.txt:
web-platform-tests/html/dom/reflection.js:

(ReflectionTests.doReflects):

5:23 PM Changeset in webkit [196882] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-forms.html for ios-simulator after r196846

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:

4:08 PM Changeset in webkit [196881] by BJ Burg

10 edits in trunk/Source/JavaScriptCore

Web Inspector: it should be possible to omit generated code guarded by INSPECTOR_ALTERNATE_DISPATCHERS
https://bugs.webkit.org/show_bug.cgi?id=154508
<rdar://problem/24759077>

Reviewed by Timothy Hatcher.

In preparation for being able to generate protocol files for WebKit2,
make it possible to not emit generated code that's guarded by
ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS). This code is not needed by
backend dispatchers generated outside of JavaScriptCore. We can't just
define it to 0 for WebKit2, since it's defined to 1 in <wtf/Platform.h>
in the configurations where the code is actually used.

Add a new opt-in Framework configuration option that turns on generating
this code. Adjust how the code is generated so that it can be easily excluded.

inspector/scripts/codegen/cpp_generator_templates.py:

Make a separate template for the declarations that are guarded.
Add an initializer expression so the order of initalizers doesn't matter.

inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:

(CppBackendDispatcherHeaderGenerator.generate_output): Add a setting check.
(CppBackendDispatcherHeaderGenerator._generate_dispatcher_declarations_for_domain):
If the declarations are needed, they will be appended to the end of the
declarations list.

inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:

(CppBackendDispatcherImplementationGenerator.generate_output): Add a setting check.
(CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command): Add a setting check.

inspector/scripts/codegen/models.py: Set the 'alternate_dispatchers' setting

to True for Framework.JavaScriptCore only. It's not needed elsewhere.

Rebaseline affected tests.

inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
inspector/scripts/tests/expected/enum-values.json-result:
inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:

4:05 PM Changeset in webkit [196880] by BJ Burg

15 edits in trunk/Source/JavaScriptCore

Web Inspector: clean up generator selection in generate-inspector-protocol-bindings.py
https://bugs.webkit.org/show_bug.cgi?id=154505
<rdar://problem/24758042>

Reviewed by Timothy Hatcher.

It should be possible to generate code for a framework using some generators
that other frameworks also use. Right now the generator selection code assumes
that use of a generator is mutually exclusive among non-test frameworks.

Make this code explicitly switch on the framework. Reorder generators
alpabetically within each case.

inspector/scripts/generate-inspector-protocol-bindings.py:

(generate_from_specification):

Rebaseline tests that are affected by generator reorderings.

inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
inspector/scripts/tests/expected/enum-values.json-result:
inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
inspector/scripts/tests/expected/type-declaration-array-type.json-result:
inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
inspector/scripts/tests/expected/type-declaration-object-type.json-result:
inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:

3:02 PM Changeset in webkit [196879] by dbates@webkit.org

2 edits
3 moves in trunk/LayoutTests

Another attempt to fix the Content Extension test failures following <https://trac.webkit.org/changeset/196875>
(https://bugs.webkit.org/show_bug.cgi?id=154307)

http/tests/contentextensions/block-cookies-in-csp-report.php.json: Renamed from LayoutTests/http/tests/contentextensions/block-cookies-in-csp-report.html.json.
http/tests/contentextensions/block-csp-report-expected.txt:
http/tests/contentextensions/block-csp-report.php.json: Renamed from LayoutTests/http/tests/contentextensions/block-csp-report.html.json.
http/tests/contentextensions/hide-on-csp-report.php.json: Renamed from LayoutTests/http/tests/contentextensions/hide-on-csp-report.html.json.

1:37 PM Changeset in webkit [196878] by dbates@webkit.org

1 edit
3 moves in trunk/LayoutTests

Attempt to fix the Content Extension test failures following <https://trac.webkit.org/changeset/196875>
(https://bugs.webkit.org/show_bug.cgi?id=154307)

http/tests/contentextensions/block-cookies-in-csp-report.php: Renamed from LayoutTests/http/tests/contentextensions/block-cookies-in-csp-report.html.
http/tests/contentextensions/block-csp-report.php: Renamed from LayoutTests/http/tests/contentextensions/block-csp-report.html.
http/tests/contentextensions/hide-on-csp-report.php: Renamed from LayoutTests/http/tests/contentextensions/hide-on-csp-report.html.

11:51 AM Changeset in webkit [196877] by dbates@webkit.org

6 edits in trunk

CSP: Violation report should include column number
https://bugs.webkit.org/show_bug.cgi?id=154418
<rdar://problem/24729525>

Reviewed by Brent Fulgham.

Source/WebCore:

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation):

LayoutTests:

Update expected results to include source file column information where the violation occurred.

http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt:

11:45 AM Changeset in webkit [196876] by dbates@webkit.org

24 edits
1 move
2 adds in trunk

CSP: Violation report should include HTTP status code and effective-directive of protected resource
https://bugs.webkit.org/show_bug.cgi?id=154288
<rdar://problem/24674982>
And
https://bugs.webkit.org/show_bug.cgi?id=115707
<rdar://problem/24383128>

Reviewed by Brent Fulgham.

Source/WebCore:

Test: http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https.html

page/csp/ContentSecurityPolicy.cpp:

LayoutTests:

http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.php
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.php
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.php

TestExpectations: Remove entries for tests that now pass. Add test http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.php.
http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive-expected.txt:
http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.html. The report-uri

directive is only honored when defined in a policy delivered via an HTTP header. We convert this
HTML file to a PHP script to be able to deliver a Content-Security-Policy HTTP header.

http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt: Update expected result now

that the report includes properties status-code and effective-directive.

http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-only-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt: Update expected result now

that the report includes properties status-code and effective-directive.

http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt: Update expected result now

that the report includes properties status-code and effective-directive.

http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https.html: Added.
http/tests/security/contentSecurityPolicy/report-uri-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-uri-from-child-frame.html: Fix ill-formed markup; substitute </iframe> for </script>.
http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt: Cosmetic change.
http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt: Ditto.
http/tests/security/contentSecurityPolicy/report-uri-scheme-relative-expected.txt: Ditto.

11:04 AM Changeset in webkit [196875] by dbates@webkit.org

22 edits
16 moves
3 adds
2 deletes in trunk

CSP: report-url directive should be ignored when contained in a policy defined via a meta element
https://bugs.webkit.org/show_bug.cgi?id=154307
<rdar://problem/24684817>

Reviewed by Brent Fulgham.

Source/WebCore:

Test: http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored.html

page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::parse): Modified to ignore the directive report-uri when
the Content Security Policy came from an HTML meta element.

LayoutTests:

TestExpectations: Update entries for renames.
http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
http/tests/security/contentSecurityPolicy/report-and-enforce.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-and-enforce.html.
http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-data-uri.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-data-uri.html.
http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-file-uri.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-file-uri.html.
http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin.html.
http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-blocked-uri.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-uri.html.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt:
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt:
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.html.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt:
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled.html.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.html.
http/tests/security/contentSecurityPolicy/report-only-expected.txt:
http/tests/security/contentSecurityPolicy/report-only.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-only.html.
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt:
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled.html.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt:
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt:
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled.html.
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies.html.
http/tests/security/contentSecurityPolicy/report-uri-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript.html.
http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-javascript.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-uri-from-javascript.html.
http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored-expected.txt: Added.
http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored.html: Added.
http/tests/security/contentSecurityPolicy/report-uri-scheme-relative-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-scheme-relative.html: Removed.
http/tests/security/contentSecurityPolicy/report-uri-scheme-relative.php: Added.
http/tests/security/contentSecurityPolicy/report-uri.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/report-uri.html.
http/tests/security/contentSecurityPolicy/resources/generate-csp-report.html: Removed. For completeness, we have

not made use of this file since <http://trac.webkit.org/changeset/176413>.

http/tests/security/contentSecurityPolicy/resources/generate-csp-report.php:
http/tests/security/contentSecurityPolicy/user-style-sheet-font-crasher.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/user-style-sheet-font-crasher.html.
platform/wk2/TestExpectations: Update entries for renames.

10:52 AM Changeset in webkit [196874] by dbates@webkit.org

7 edits
2 moves
6 adds
6 deletes in trunk

CSP: sandbox directive should be ignored when contained in a policy defined via a meta element
https://bugs.webkit.org/show_bug.cgi?id=154299
<rdar://problem/24680433>

Reviewed by Brent Fulgham.

Source/WebCore:

Tests: http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header2.php

http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe.php
http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header.php
http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored.html

dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Substitute ContentSecurityPolicy::processHTTPEquiv() for
ContentSecurityPolicy::didReceiveHeader() as the latter was made private.

page/csp/ContentSecurityPolicy.cpp:

page/csp/ContentSecurityPolicy.h: Made member function ContentSecurityPolicy::didReceiveHeader() private. Defined

page/csp/ContentSecurityPolicyDirectiveList.cpp:

page/csp/ContentSecurityPolicyDirectiveList.h:

LayoutTests:

http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header2-expected.txt: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-expected.txt.
http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header2.php: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts.html.

http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-subframe-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-subframe.html: Removed.

http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe-expected.txt: Added.
http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe.php: Added. Derived from test http/tests/security/contentSecurityPolicy/sandbox-empty-subframe.html.

http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-expected.txt: Added.
http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header.php: Added. Derived from test http/tests/security/contentSecurityPolicy/sandbox-empty.html.

http/tests/security/contentSecurityPolicy/sandbox-empty-subframe-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/sandbox-empty-subframe.html: Removed.

http/tests/security/contentSecurityPolicy/sandbox-empty-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/sandbox-empty.html: Removed.

http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored-expected.txt: Added.
http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored.html: Added.

10:43 AM Changeset in webkit [196873] by ggaren@apple.com

11 edits in trunk/Source/bmalloc

bmalloc: Don't use a whole page for metadata
https://bugs.webkit.org/show_bug.cgi?id=154510

Reviewed by Andreas Kling.

(1) Don't round up metadata to a page boundary. This saves 1.5% dirty
memory on iOS and 0.2% on Mac. It also enables a future patch to allocate
smaller chunks without wasting memory.

(2) Initialize metadata lazily. This saves dirty memory when the program
allocates primarily small or large objects (but not both), leaving some
metadata uninitialized.

bmalloc.xcodeproj/project.pbxproj: Medium objects are gone now.

bmalloc/BumpAllocator.h:

(bmalloc::BumpAllocator::refill): Added an ASSERT to help debug a bug
I cause while working on this patch.

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateSmallBumpRanges): Ditto.

(bmalloc::Heap::splitAndAllocate):
(bmalloc::Heap::allocateLarge): Updated for interface change.

bmalloc/LargeChunk.h: Changed the boundaryTagCount calculation to

a static_assert.

Don't round up to page boundary. (See above.)

(bmalloc::LargeChunk::LargeChunk): Moved code here from LargeChunk::init.
A constructor is a more natural / automatic way to do this initialization.

bmalloc/LargeObject.h:

(bmalloc::LargeObject::init): Deleted. Moved to LargeChunk.

bmalloc/Sizes.h: Chagned largeChunkMetadataSize to a simpler constant

because metadata size no longer varies by page size.

bmalloc/SmallChunk.h:

(bmalloc::SmallChunk::begin):
(bmalloc::SmallChunk::end):
(bmalloc::SmallChunk::lines):
(bmalloc::SmallChunk::pages): Use std::array to make begin/end
calculations easier.

bmalloc/SuperChunk.h:

bmalloc/VMHeap.cpp:

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateSmallPage):
(bmalloc::VMHeap::allocateLargeObject): Specify whether we're allocating
a small or large chunk since we don't allocate both at once anymore.

10:18 AM Changeset in webkit [196872] by commit-queue@webkit.org

7 edits
2 deletes in trunk

Unreviewed, rolling out r196866.
https://bugs.webkit.org/show_bug.cgi?id=154515

still crashy on EFL/GTK (Requested by smfr on #webkit).

Reverted changeset:

"Wheel event callback removing the window causes crash in
WebCore."
https://bugs.webkit.org/show_bug.cgi?id=150871
http://trac.webkit.org/changeset/196866

Feb 20, 2016:

10:14 PM Changeset in webkit [196871] by mark.lam@apple.com

4 edits in trunk/Source

Use of inlined asm statements causes problems for -std=c99 builds.
https://bugs.webkit.org/show_bug.cgi?id=154507

Reviewed by Dan Bernstein.

Source/bmalloc:

bmalloc/BAssert.h:

Source/WTF:

https://gcc.gnu.org/onlinedocs/gcc/Extended-Asm.html says "When writing code that
can be compiled with -ansi and the various -std options, use asm instead of
asm (see Alternate Keywords)."

So, to be a good citizen, we can change the use of "asm" in CRASH() to "asm"
so that we don't break the build of such other projects.

wtf/Assertions.h:

5:54 PM Changeset in webkit [196870] by rniwa@webkit.org

3 edits in trunk/Websites/perf.webkit.org

Add the support for universal slave password
https://bugs.webkit.org/show_bug.cgi?id=154476

Reviewed by David Kilzer.

Added the support for universalSlavePassword.

config.json:
public/include/report-processor.php:

(ReportProcessor::process):
(ReportProcessor::authenticate_and_construct_build_data): Extracted from process().

4:17 PM Changeset in webkit [196869] by commit-queue@webkit.org

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Opacity slider thumb sometimes goes past the bar in Visual Styles sidebar
https://bugs.webkit.org/show_bug.cgi?id=154497

Patch by Devin Rousso <Devin Rousso> on 2016-02-20
Reviewed by Timothy Hatcher.

UserInterface/Views/Slider.js:

(WebInspector.Slider.prototype.recalculateKnobX):
Resets the maxX value to 0 to ensure that a new maxX is calculated with
the current width.

UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.js:

(WebInspector.VisualStyleCommaSeparatedKeywordEditor.prototype.set specifiedWidth): Deleted.
(WebInspector.VisualStyleCommaSeparatedKeywordEditor.prototype.recalculateWidth):

UserInterface/Views/VisualStyleDetailsPanel.js:

UserInterface/Views/VisualStyleUnitSlider.js:

(WebInspector.VisualStyleUnitSlider.prototype.recalculateWidth):

3:51 PM Changeset in webkit [196868] by sbarati@apple.com

14 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Implement Proxy.Construct
https://bugs.webkit.org/show_bug.cgi?id=154440

Reviewed by Oliver Hunt.

This patch is mostly an implementation of
Proxy.Construct with respect to section 9.5.13
of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-construct-argumentslist-newtarget

This patch also changes op_create_this to accept new.target's
that aren't JSFunctions. This is necessary implementing Proxy.Construct
because we might construct a JSFunction with a new.target being
a Proxy. This will also be needed when we implement Reflect.construct.

dfg/DFGOperations.cpp:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_create_this):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_create_this):

llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::finishCreation):
(JSC::ProxyObject::visitChildren):
(JSC::performProxyConstruct):
(JSC::ProxyObject::getConstructData):

runtime/ProxyObject.h:
tests/es6.yaml:
tests/stress/proxy-construct.js: Added.

(assert):
(throw.new.Error.let.target):
(throw.new.Error):
(assert.let.target):
(assert.let.handler.get construct):
(let.target):
(let.handler.construct):
(i.catch):
(assert.let.handler.construct):
(assert.let.construct):
(assert.else.assert.let.target):
(assert.else.assert.let.construct):
(assert.else.assert):
(new.proxy.let.target):
(new.proxy.let.construct):
(new.proxy):

2:47 PM Changeset in webkit [196867] by commit-queue@webkit.org

4 edits in trunk/Source/WebInspectorUI

Web Inspector: Visual Styles: Modifying background expands Font section
https://bugs.webkit.org/show_bug.cgi?id=154491
<rdar://problem/24755440>

Patch by Devin Rousso <Devin Rousso> on 2016-02-20
Reviewed by Timothy Hatcher.

UserInterface/Base/Utilities.js:

(String.prototype.toCamelCase):
Added utility function to transform a string into a camel-cased version.

UserInterface/Models/DOMNodeStyles.js:

UserInterface/Views/VisualStyleDetailsPanel.js:

1:21 PM Changeset in webkit [196866] by Simon Fraser

7 edits
2 adds in trunk

Wheel event callback removing the window causes crash in WebCore.
https://bugs.webkit.org/show_bug.cgi?id=150871

Reviewed by Brent Fulgham.

Source/WebCore:

Null check the FrameView before using it, since the iframe may have been removed
from its parent document inside the event handler.

The new test triggered a cross-load side-effect, where wheel event filtering wasn't
reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
which resets the filtering.

Test: fast/events/wheel-event-destroys-frame.html

page/EventHandler.cpp:

(WebCore::EventHandler::clear):
(WebCore::EventHandler::clearLatchedState):

page/Frame.cpp:

(WebCore::Frame::setView): If the view doesn't change (e.g. was and is null)
don't bother clearing the event handler; should avoid EventHandler::clearLatchedState()
from accessing a deleted MainFrame.

page/WheelEventDeltaFilter.cpp:

(WebCore::WheelEventDeltaFilter::filteredDelta):

page/mac/EventHandlerMac.mm:

(WebCore::EventHandler::platformCompleteWheelEvent):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollTo):

LayoutTests:

fast/events/wheel-event-destroys-frame-expected.txt: Added.
fast/events/wheel-event-destroys-frame.html: Added.

11:51 AM Changeset in webkit [196865] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline inspector/model/remote-object.html for Mac after r196846

Unreviewed test gardening.

platform/mac/inspector/model/remote-object-expected.txt:

10:29 AM Changeset in webkit [196864] by Antti Koivisto

7 edits in trunk/Source/WebCore

Resolve style iteratively
https://bugs.webkit.org/show_bug.cgi?id=154355

Reviewed by Andreas Kling.

Instead of a set of recursive functions use ComposedTreeIterator for traversing the DOM
tree in composed tree order.

This, along with maintaining explicit parent stack makes style resolve code more tractable
for future work.

The render tree building code path remains recursive for now.

css/StyleInvalidationAnalysis.cpp:

(WebCore::StyleInvalidationAnalysis::invalidateIfNeeded):

Invalidate the host element instead of the shadow root. This reduces need for special handling for shadow roots.

dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::initializeContextStack):
(WebCore::ComposedTreeIterator::dropAssertions):

Add support for dropping DOM mutation assertions.

(WebCore::ComposedTreeIterator::traverseShadowRoot):

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::context):
(WebCore::ComposedTreeIterator::current):

dom/PseudoElement.h:
style/StyleTreeResolver.cpp:

Maintain explicit parent stack.

(WebCore::Style::TreeResolver::resolveComposedTree):

The main loop that iterates over the composed tree and computes style for dirty elements.

Recursive functions go away.

style/StyleTreeResolver.h:

(WebCore::Style::TreeResolver::scope):
(WebCore::Style::TreeResolver::parent):

10:16 AM Changeset in webkit [196863] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Text Align segmented control blinks while editing other properties in Visual Styles sidebar
https://bugs.webkit.org/show_bug.cgi?id=154487
<rdar://problem/24754703>

Patch by Devin Rousso <Devin Rousso> on 2016-02-20
Reviewed by Timothy Hatcher.

UserInterface/Views/VisualStyleKeywordIconList.js:

(WebInspector.VisualStyleKeywordIconList.prototype.set value):
(WebInspector.VisualStyleKeywordIconList.prototype._handleKeywordChanged):

9:02 AM Changeset in webkit [196862] by akling@apple.com

2 edits in trunk/Source/WebCore

REGRESSION(r196780): Fake memory handler takes too long to run now.

Unreviewed bot fix.

Put the footprint comparison code behind a compile-time flag for now.
It's taking too long to run on bots, and memory is getting measured
before all the pressure relief code has a chance to run.

platform/cocoa/MemoryPressureHandlerCocoa.mm:

(WebCore::MemoryPressureHandler::install):

8:42 AM Changeset in webkit [196861] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

Do not require UDate in LocaleICU with !ENABLE_DATE_AND_TIME_INPUT_TYPES
https://bugs.webkit.org/show_bug.cgi?id=154483

Patch by Olivier Blin <Olivier Blin> on 2016-02-20
Reviewed by Michael Catanzaro.

Put initializeShortDateFormat(), dateFormat(), m_shortDateFormat and
m_didCreateShortDateFormat under flag, since they are only used by
code under the ENABLE_DATE_AND_TIME_INPUT_TYPES flag.

This helps to build with a light ICU that does not provide UDate
features (with UCONFIG_NO_FORMATTING).

platform/text/LocaleICU.cpp:

(WebCore::LocaleICU::LocaleICU):
(WebCore::LocaleICU::~LocaleICU):
(WebCore::createFallbackMonthLabels): Deleted.
(WebCore::createFallbackAMPMLabels): Deleted.

platform/text/LocaleICU.h:

8:31 AM Changeset in webkit [196860] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Remove declaration of unimplemented methods in LocaleICU
https://bugs.webkit.org/show_bug.cgi?id=154482

Patch by Olivier Blin <Olivier Blin> on 2016-02-20
Reviewed by Michael Catanzaro.

detectSignAndGetDigitRange() and matchedDecimalSymbolIndex() are
implemented in PlatformLocale, not LocaleICU.

They were moved out from LocaleICU to NumberLocalizer in r124459
(2012), which has then been renamed as Localizer, then Locale, and
finally PlatformLocale.

platform/text/LocaleICU.h:

8:30 AM Changeset in webkit [196859] by commit-queue@webkit.org

4 edits in trunk

[cmake] Use ICU include dirs in WebKit2 and WebKitTestRunner
https://bugs.webkit.org/show_bug.cgi?id=154479

Patch by Olivier Blin <Olivier Blin> on 2016-02-20
Reviewed by Michael Catanzaro.

Source/WebKit2:

CMakeLists.txt:

Tools:

WebKitTestRunner/CMakeLists.txt:

3:01 AM Changeset in webkit [196858] by commit-queue@webkit.org

6 edits
2 deletes in trunk

Unreviewed, rolling out r196837.
https://bugs.webkit.org/show_bug.cgi?id=154495

It caused a lot of crashes in EFL and GTK bots (Requested by
KaL on #webkit).

Reverted changeset:

"Wheel event callback removing the window causes crash in
WebCore."
https://bugs.webkit.org/show_bug.cgi?id=150871
http://trac.webkit.org/changeset/196837

12:40 AM Changeset in webkit [196857] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Placeholder text in Visual Styles sidebar table row should be white
https://bugs.webkit.org/show_bug.cgi?id=154488
<rdar://problem/24754715>

Reviewed by Timothy Hatcher.

UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.css:

Feb 19, 2016:

10:31 PM Changeset in webkit [196856] by jh718.park@samsung.com

2 edits in trunk/Source/bmalloc

Unreviewed. Fix debug build error since r196847

Fix gcc build warning appeared as below
by removing BASSERT(refCount <= maxRefCount).
error: comparison is always true due to limited range of data type
[-Werror=type-limits]

bmalloc/SmallLine.h:

(bmalloc::SmallLine::ref): Deleted.

9:51 PM Changeset in webkit [196855] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Inherited selector rows have text too low
https://bugs.webkit.org/show_bug.cgi?id=154489
<rdar://problem/24754774>

Reviewed by Timothy Hatcher.

UserInterface/Views/VisualStyleSelectorSection.css:

(.details-section.visual-style-selector-section > .content > .selectors > .selector-list > .section-divider):

8:41 PM Changeset in webkit [196854] by Chris Dumez

5 edits in trunk/Source/WebCore

Land release assertions to help track down a possible HTMLCollection lifetime bug
https://bugs.webkit.org/show_bug.cgi?id=154490

Reviewed by Ryosuke Niwa.

Land release assertions to help track down a possible HTMLCollection
lifetime bug: <rdar://problem/24457478>.

bindings/js/JSHTMLCollectionCustom.cpp:

(WebCore::JSHTMLCollection::getOwnPropertyNames):

html/HTMLCollection.cpp:

(WebCore::HTMLCollection::HTMLCollection):
(WebCore::HTMLCollection::~HTMLCollection):

html/HTMLCollection.h:

(WebCore::HTMLCollection::wasDeletionStarted):

html/HTMLCollection.idl:

8:17 PM Changeset in webkit [196853] by commit-queue@webkit.org

3 edits
2 adds in trunk

Source/WebCore:
Bug 154366 - AX: AXObjectCache::visiblePositionForTextMarkerData() doesn't account for equivalent visibly equivalent positions
https://bugs.webkit.org/show_bug.cgi?id=154366

Patch by Doug Russell <d_russell@apple.com> on 2016-02-19
Reviewed by Chris Fleizach.

Test: accessibility/mac/text-marker-line-boundary.html

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::visiblePositionForTextMarkerData):

LayoutTests:
Bug 154366: AX: AXObjectCache::visiblePositionForTextMarkerData() doesn't account for visibly equivalent positions
https://bugs.webkit.org/show_bug.cgi?id=154366

Patch by Doug Russell <d_russell@apple.com> on 2016-02-19
Reviewed by Chris Fleizach.

accessibility/mac/text-marker-line-boundary-expected.txt: Added.
accessibility/mac/text-marker-line-boundary.html: Added.

7:24 PM Changeset in webkit [196852] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Color picker in Visual Styles sidebar should not default to zero alpha
https://bugs.webkit.org/show_bug.cgi?id=154474
<rdar://problem/24750217>

Patch by Devin Rousso <Devin Rousso> on 2016-02-19
Reviewed by Timothy Hatcher.

UserInterface/Views/InlineSwatch.js:

(WebInspector.InlineSwatch.prototype._fallbackValue):
Changed the fallback value for color from transparent to white so that
the color picker starts out with an alpha value of 1.

(WebInspector.InlineSwatch.prototype._handleContextMenuEvent):
Prevents context menu events from having an effect if there is no value
for them to modify.

6:47 PM Changeset in webkit [196851] by Simon Fraser

3 edits in trunk/Source/WebCore

Use more concrete types for parsing positions
https://bugs.webkit.org/show_bug.cgi?id=154481

Reviewed by Dean Jackson.

Use CSSPrimitiveValues for position-parsing functions where possible, to avoid
the need to downcast<> the values returned by the parsing functions.

css/CSSParser.cpp:

css/CSSParser.h:

5:58 PM Changeset in webkit [196850] by Sukolsak Sakshuwong

10 edits in trunk

[INTL] Implement Number Format Functions
https://bugs.webkit.org/show_bug.cgi?id=147605

Reviewed by Darin Adler.

Source/JavaScriptCore:

This patch implements Intl.NumberFormat.prototype.format() according
to the ECMAScript 2015 Internationalization API spec (ECMA-402 2nd edition.)

runtime/IntlNumberFormat.cpp:

(JSC::IntlNumberFormat::UNumberFormatDeleter::operator()):
(JSC::IntlNumberFormat::initializeNumberFormat):
(JSC::IntlNumberFormat::createNumberFormat):
(JSC::IntlNumberFormat::formatNumber):
(JSC::IntlNumberFormatFuncFormatNumber): Deleted.

runtime/IntlNumberFormat.h:
runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatFuncFormatNumber):

LayoutTests:

js/intl-numberformat-expected.txt:
js/intl-numberformat.html:
js/number-toLocaleString-expected.txt:
js/script-tests/intl-numberformat.js:
js/script-tests/number-toLocaleString.js:

5:51 PM Changeset in webkit [196849] by barraclough@apple.com

5 edits
3 adds in trunk

JSObject::getPropertySlot - index-as-propertyname, override on prototype, & shadow
https://bugs.webkit.org/show_bug.cgi?id=154416

Reviewed by Geoff Garen.

Source/JavaScriptCore:

Here's the bug. Suppose you call JSObject::getOwnProperty and -

PropertyName contains an index,
An object on the prototype chain overrides getOwnPropertySlot, and has that index property,
The base of the access (or another object on the prototype chain) shadows that property.

runtime/JSObject.h:

(JSC::JSObject::getOwnNonIndexPropertySlot):

renamed from inlineGetOwnPropertySlot to better describe behaviour; added ASSERT guarding that this method never returns index properties - if it ever does, this is unsafe for getPropertySlot.

(JSC::JSObject::getOwnPropertySlot):

inlineGetOwnPropertySlot -> getOwnNonIndexPropertySlot.

(JSC::JSObject::getPropertySlot):

In case of object overriding getOwnPropertySlot check if propertyName is an index.

(JSC::JSObject::getNonIndexPropertySlot):

called by getPropertySlot if we encounter an object that overrides getOwnPropertySlot, in order to avoid repeated calls to parseIndex.

(JSC::JSObject::inlineGetOwnPropertySlot): Deleted.

this was renamed to getOwnNonIndexPropertySlot.

(JSC::JSObject::fastGetOwnPropertySlot): Deleted.

this was folded back in to getPropertySlot.

Source/WebCore:

testing/Internals.cpp:

(WebCore::Internals::isReadableStreamDisturbed):

fastGetOwnPropertySlot -> getOwnPropertySlot (internal method removed; test shouldn't really have been using this anyway)

LayoutTests:

js/index-property-shadows-overriden-get-own-property-slot-expected.txt: Added.
js/index-property-shadows-overriden-get-own-property-slot.html: Added.
js/script-tests/index-property-shadows-overriden-get-own-property-slot.js: Added.

(test):

added test case.

5:37 PM Changeset in webkit [196848] by BJ Burg

8 edits in trunk/Source/WebKit2

WebAutomationSession should tell its delegate when its remote end disconnects
https://bugs.webkit.org/show_bug.cgi?id=154426
<rdar://problem/24732382>

Reviewed by Timothy Hatcher.

The client might want to free up resources or close spawned windows
if the remote end has disconnected from the automation session.

UIProcess/API/APIAutomationSessionClient.h:

(API::AutomationSessionClient::didDisconnectFromRemote): Added.
(API::AutomationSessionClient::didRequestNewWindow):
Remove WebProcessPool* argument as it is never used.

UIProcess/API/Cocoa/_WKAutomationSession.h:
UIProcess/API/Cocoa/_WKAutomationSession.mm:

(-[_WKAutomationSession isPaired]):
Expose whether the session is paired with a remote end.

UIProcess/API/Cocoa/_WKAutomationSessionDelegate.h: Add method.
UIProcess/Cocoa/AutomationSessionClient.h: Add method.

Remove WebProcessPool* argument as it is never used.

UIProcess/Cocoa/AutomationSessionClient.mm:

(WebKit::AutomationSessionClient::AutomationSessionClient):
(WebKit::AutomationSessionClient::didRequestNewWindow):
(WebKit::AutomationSessionClient::didDisconnectFromRemote):
Add necessary forwarding boilerplate.

UIProcess/WebAutomationSession.cpp:

(WebKit::WebAutomationSession::disconnect): Inform the client.

5:06 PM Changeset in webkit [196847] by ggaren@apple.com

5 edits
3 moves
1 delete in trunk/Source/bmalloc

bmalloc: Chunk, Page, and Line don't need to be class templates
https://bugs.webkit.org/show_bug.cgi?id=154480

Reviewed by Gavin Barraclough.

We needed class templates to distinguish between small and medium,
but medium is gone now.

bmalloc.xcodeproj/project.pbxproj:
bmalloc/Chunk.h: Removed.
bmalloc/Heap.cpp:

(bmalloc::Heap::initializeLineMetadata):
(bmalloc::Heap::allocateSmallBumpRanges):

bmalloc/Heap.h:
bmalloc/Line.h: Removed.
bmalloc/Page.h: Removed.
bmalloc/Sizes.h:
bmalloc/SmallChunk.h: Replaced with Source/bmalloc/bmalloc/Chunk.h.

bmalloc/SmallLine.h: Replaced with Source/bmalloc/bmalloc/Line.h.

bmalloc/SmallPage.h: Replaced with Source/bmalloc/bmalloc/Page.h.

bmalloc/SmallTraits.h: Removed.

4:09 PM Changeset in webkit [196846] by Chris Dumez

11 edits in trunk

HTMLFormElement.autocomplete should only return known values
https://bugs.webkit.org/show_bug.cgi?id=154247
<rdar://problem/24658195>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline a couple of W3C HTML tests now that more checks are passing.

web-platform-tests/html/dom/reflection-forms-expected.txt:
web-platform-tests/html/semantics/forms/the-form-element/form-autocomplete-expected.txt:

Source/WebCore:

Update HTMLFormElement.autocomplete to only return known values:

Also, update HTMLInputElement.autocomplete to fall back to using the form
owner's autocomplete attribute ("on" or "off") when it's autocomplete
attribute is omitted and the input element is wearing the "autofill
expectation mantle" (i.e. the input is not hidden). If there is no
form owner, the "on" value is used instead. This behavior is specified
in:
https://html.spec.whatwg.org/multipage/forms.html#autofilling-form-controls:-the-autocomplete-attribute:attr-fe-autocomplete-7

No new tests, already covered by existing tests.

html/HTMLFormControlElement.cpp:

(WebCore::HTMLFormControlElement::autocomplete):

html/HTMLFormElement.cpp:

(WebCore::HTMLFormElement::setAutocomplete):
(WebCore::HTMLFormElement::autocomplete):

html/HTMLFormElement.h:
html/HTMLFormElement.idl:

LayoutTests:

Update test to expect Form.autocomplete to return "on" by
default instead of the empty string.

fast/forms/autocomplete-expected.txt:
fast/forms/autocomplete.html:

4:03 PM Changeset in webkit [196845] by ggaren@apple.com

19 edits
4 deletes in trunk/Source/bmalloc

bmalloc: Remove the concept of medium objects
https://bugs.webkit.org/show_bug.cgi?id=154436

Reviewed by Sam Weinig.

This change reduces memory use because it eliminates the 1kB line size,
so we don't have to hold down 1kB lines for individual 264+ byte objects.

This change speeds up small object benchmarks because it eliminates the
branch to detect medium objects in deallocation log processing.

bmalloc.xcodeproj/project.pbxproj: Removed all the medium files. We

can simplify even further in a follow-up patch, removing the base class
templates for Chunk, Page, and Line as well.

bmalloc/Allocator.cpp:

bmalloc/Allocator.h:

(bmalloc::Allocator::allocateFastCase): Ditto.

bmalloc/BumpAllocator.h:

(bmalloc::BumpAllocator::validate):
(bmalloc::BumpAllocator::allocate): No more medium.

bmalloc/Chunk.h: No more medium.

bmalloc/Deallocator.cpp:

(bmalloc::Deallocator::processObjectLog): No check for medium. This is
a speedup.

(bmalloc::Deallocator::deallocateSlowCase): No more medium.

bmalloc/Deallocator.h:

(bmalloc::Deallocator::deallocateFastCase): Ditto.

bmalloc/Heap.cpp:

(bmalloc::Heap::scavenge):
(bmalloc::Heap::scavengeSmallPages):
(bmalloc::Heap::scavengeLargeObjects): Medium is gone.

(bmalloc::Heap::allocateSmallBumpRanges): Allow for lines that allocate
zero objects. This happens when an object spans more than two lines --
the middle lines allocate zero objects.

(bmalloc::Heap::allocateSmallPage): This code didn't change; I just removed
the medium code.

(bmalloc::Heap::deallocateSmallLine): Changed the algorithm to check
hasFreeLines. See allocateSmallBumpRanges.

(bmalloc::Heap::scavengeMediumPages): Deleted.
(bmalloc::Heap::allocateMediumBumpRanges): Deleted.
(bmalloc::Heap::allocateMediumPage): Deleted.
(bmalloc::Heap::deallocateMediumLine): Deleted.

bmalloc/Heap.h:

(bmalloc::Heap::derefMediumLine): Deleted.

bmalloc/LargeChunk.h:

(bmalloc::LargeChunk::get):
(bmalloc::LargeChunk::endTag):

bmalloc/Line.h: No more medium.

bmalloc/MediumChunk.h: Removed.
bmalloc/MediumLine.h: Removed.
bmalloc/MediumPage.h: Removed.
bmalloc/MediumTraits.h: Removed.

bmalloc/ObjectType.cpp:

(bmalloc::objectType):

bmalloc/ObjectType.h:

(bmalloc::isSmall):
(bmalloc::isXLarge):
(bmalloc::isSmallOrMedium): Deleted.
(bmalloc::isMedium): Deleted. No more medium.

bmalloc/Page.h:

So do that.

bmalloc/Sizes.h:

(bmalloc::Sizes::sizeClass): Expand the small size class to include the
medium size class.

bmalloc/SuperChunk.h:

(bmalloc::SuperChunk::SuperChunk):
(bmalloc::SuperChunk::smallChunk):
(bmalloc::SuperChunk::largeChunk):
(bmalloc::SuperChunk::mediumChunk): Deleted. No more medium.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::grow):

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateSmallPage): Set the has free lines bit before
returning a Page to the Heap since this is the correct default state
when we first allocate a page.

(bmalloc::VMHeap::allocateMediumPage): Deleted.
(bmalloc::VMHeap::deallocateMediumPage): Deleted.

4:01 PM Changeset in webkit [196844] by commit-queue@webkit.org

2 edits in trunk/Tools

[GTK] Fixed link error when G_DEFINE_AUTOPTR_CLEANUP_FUNC is not defined.
https://bugs.webkit.org/show_bug.cgi?id=154467

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-19
Reviewed by Michael Catanzaro.

TestWebKitAPI/Tests/WebKit2Gtk/TestAutocleanups.cpp:

(beforeAll):
(afterAll):

3:56 PM Changeset in webkit [196843] by Matt Baker

3 edits in trunk/Source/WebInspectorUI

Web Inspector: CSS var() function should be syntax highlighted
https://bugs.webkit.org/show_bug.cgi?id=154406
<rdar://problem/24726136>

Reviewed by Timothy Hatcher.

UserInterface/Models/CSSCompletions.js:

Added "var" to CodeMirror value keywords for syntax highlighting.

UserInterface/Models/CSSKeywordCompletions.js:

(WebInspector.CSSKeywordCompletions.forProperty):
Added "var" to accepted keywords for auto-completion.

3:33 PM Changeset in webkit [196842] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/LayoutTests

Rebaseline js/dom/global-constructors-attributes expectation for Mavericks. rdar://problem/24748489

platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt:

Account for HTMLPictureElement support.

3:28 PM Changeset in webkit [196841] by matthew_hanson@apple.com

3 edits in branches/safari-601-branch/LayoutTests

Skip inspector/css/modify-rule-selector.html. rdar://problem/24748351

This test relies on TestPage infrastructure which is not present on the branch.

TestExpectations:

Skip inspector/css/modify-rule-selector.html

platform/mac-wk2/TestExpectations:

Remove expectation for inspector/css/modify-rule-selector.html

3:27 PM Changeset in webkit [196840] by msaboff@apple.com

13 edits
1 move in trunk/Source/bmalloc

bmalloc: Unify VMHeap and Heap LargeObjects free lists to reduce fragmentation
https://bugs.webkit.org/show_bug.cgi?id=154192

Reviewed by Geoffrey Garen.

Change the operation of Heap and VMHeap LargeObject free lists.
Renamed Owner to VMState to track the state of each LargeObject.

Physical - The pages have been allocated.
Virtual - The pages have not been allocated.
Mixed - The object contains a mixture of Physical and Virtual pages.

VMState uses one bit each for Physical and Virtual to simplify merging states
when merging two adjacent blocks. This change enforces the rule that objects in
the Heap free list must have have the Physical bit set in their VMState while objects
in the VMHeap free list must have the Physical bit clear. Thie means that the Heap
can have LargeObjects in Physical or Mixed VMState, but the VMHeap's free list can
only contain Virtual LargeObjects.

In both Heap::allocateLarge(), we now allocate physical pages if the LargeObject we
pull from the free list has any Virtual pages before we possilby split the
object. When we merge objects, the result might be made up of Mixed page allocations.
When allocating a Mixed LargeObject, we need to allocate memory for them as well.
The scavenger deallocates both Physical and Mixed LargeObjects, placing them back into
the VMHeap's free list.

When we allocate or deallocate Mixed LargeObjects, there are pages that within these
objects that will be redundantly modified. It would require additional metadata to
eliminate this redundancy.

bmalloc.xcodeproj/project.pbxproj:
bmalloc/BoundaryTag.h:

(bmalloc::BoundaryTag::vmState): New helper.
(bmalloc::BoundaryTag::setVMState): New helper.
(bmalloc::BoundaryTag::owner): Deleted.
(bmalloc::BoundaryTag::setOwner): Deleted.

bmalloc/Heap.h:

(bmalloc::Heap::splitAndAllocate): New helpers.

bmalloc/LargeObject.h:

(bmalloc::LargeObject::vmState): New helper.
(bmalloc::LargeObject::setVMState): New helper.

bmalloc/Heap.cpp:

(bmalloc::Heap::splitAndAllocate): New helpers.
(bmalloc::Heap::allocateLarge):
(bmalloc::Heap::deallocatePhysicalPages): Refactored from VMHeap::deallocateLargeObjectMemory.

bmalloc/FreeList.cpp:

(bmalloc::FreeList::takeGreedy):
(bmalloc::FreeList::take):
(bmalloc::FreeList::removeInvalidAndDuplicateEntries):

bmalloc/FreeList.h:

(bmalloc::FreeList::FreeList):
(bmalloc::FreeList::push):

bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):
(bmalloc::Heap::scavengeLargeObjects):

bmalloc/LargeObject.h:

(bmalloc::LargeObject::isValidAndFree):
(bmalloc::LargeObject::validateSelf):

bmalloc/SegregatedFreeList.cpp:

(bmalloc::SegregatedFreeList::SegregatedFreeList): Changed to initialize our required Physical state.

bmalloc/SegregatedFreeList.h:

bmalloc/LargeObject.h:

bmalloc/LargeObject.h:

(bmalloc::LargeObject::owner): Deleted.
(bmalloc::LargeObject::setOwner): Deleted.

bmalloc/Owner.h: Removed.

bmalloc/VMAllocate.h:

(bmalloc::vmAllocatePhysicalPagesSloppy): Changed to round begin down to eliminate the left to right
allocation constraint.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::grow): Large space managed like small or medium as a vector of LargeChunks.
(bmalloc::VMHeap::VMHeap): Changed to initialize our required Physical state.

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateLargeObject): These no longer allocate memory.
(bmalloc::VMHeap::deallocateLargeObject): Removed setOwner. Now we set the VMState after any merges.

bmalloc/VMState.h: Copied from Source/bmalloc/bmalloc/Owner.h.

3:24 PM Changeset in webkit [196839] by Chris Dumez

2 edits in trunk/Source/WebCore

Drop UnsafeVectorOverflow on ElementDescendantConstIterator::m_ancestorSiblingStack
https://bugs.webkit.org/show_bug.cgi?id=154477

Reviewed by Ryosuke Niwa.

Drop UnsafeVectorOverflow on ElementDescendantConstIterator::m_ancestorSiblingStack to
restore bounds checking.

Andreas already dropped in on ElementDescendantIterator::m_ancestorSiblingStack in
r178253 but did not update the "Const" counterpart.

dom/ElementDescendantIterator.h:

3:03 PM Changeset in webkit [196838] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/LayoutTests

Remove extraneous '-' from parse-filter-image test expectation. rdar://problem/24743218

2:59 PM Changeset in webkit [196837] by Simon Fraser

6 edits
2 adds in trunk

Wheel event callback removing the window causes crash in WebCore.
https://bugs.webkit.org/show_bug.cgi?id=150871

Reviewed by Brent Fulgham.

Source/WebCore:

Null check the FrameView before using it, since the iframe may have been removed
from its parent document inside the event handler.

The new test triggered a cross-load side-effect, where wheel event filtering wasn't
reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
which resets the filtering.

Test: fast/events/wheel-event-destroys-frame.html

page/EventHandler.cpp:

(WebCore::EventHandler::clear):

page/WheelEventDeltaFilter.cpp:

(WebCore::WheelEventDeltaFilter::filteredDelta):

page/mac/EventHandlerMac.mm:

(WebCore::EventHandler::platformCompleteWheelEvent):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollTo):

LayoutTests:

fast/events/wheel-event-destroys-frame-expected.txt: Added.
fast/events/wheel-event-destroys-frame.html: Added.

2:56 PM Changeset in webkit [196836] by sbarati@apple.com

4 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Implement Proxy.Call
https://bugs.webkit.org/show_bug.cgi?id=154425

Reviewed by Mark Lam.

This patch is a straight forward implementation of
Proxy.Call with respect to section 9.5.12
of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-call-thisargument-argumentslist

runtime/ProxyObject.cpp:

(JSC::ProxyObject::finishCreation):
(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::getOwnPropertySlotByIndex):
(JSC::performProxyCall):
(JSC::ProxyObject::getCallData):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h:

(JSC::ProxyObject::create):

tests/es6.yaml:
tests/stress/proxy-call.js: Added.

(assert):
(throw.new.Error.let.target):
(throw.new.Error.let.handler.apply):
(throw.new.Error):
(assert.let.target):
(assert.let.handler.get apply):
(let.target):
(let.handler.apply):
(i.catch):
(assert.let.handler.apply):

2:28 PM Changeset in webkit [196835] by mmaxfield@apple.com

2 edits in trunk/Source/WebCore

[Win] [SVG -> OTF Converter] All uses of a font except the first one are invisible
https://bugs.webkit.org/show_bug.cgi?id=154465

Reviewed by Alex Christensen.

We should re-use the existing converted data if it exists.

Covered by existing tests.

css/CSSFontFaceSource.cpp:

(WebCore::CSSFontFaceSource::font):

2:15 PM Changeset in webkit [196834] by Beth Dakin

5 edits in trunk/Source/WebKit2

Enhance EditorState to include TypingAttributes, alignment, and color
https://bugs.webkit.org/show_bug.cgi?id=154424

Reviewed by Dean Jackson and Sam Weinig.

TypingAttributes is already available for iOS and GTK. This patch hooks
that up on Mac as well, and it moves the calculation of that to the shared
file since there is no reason for this to be written in an iOS-only way. This
patch also adds textColor and textAlignment to EditorState, and since those
are not technically platform-specific either, they are also calculated in the
shared editorState() function.

Shared/EditorState.cpp:

(WebKit::EditorState::PostLayoutData::encode):
(WebKit::EditorState::PostLayoutData::decode):

Shared/EditorState.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::editorState):

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::platformEditorState):

1:49 PM Changeset in webkit [196833] by Antti Koivisto

7 edits
2 adds in trunk

ComposedTreeIterator traverses normal children for elements with empty shadow root
https://bugs.webkit.org/show_bug.cgi?id=154464

Reviewed by Ryosuke Niwa.

Source/WebCore:

Test: fast/shadow-dom/composed-tree-basic.html

dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::initializeContextStack):
(WebCore::ComposedTreeIterator::traverseShadowRoot):

If the shadow root is empty continue by skipping the real children.

(WebCore::ComposedTreeIterator::traverseNextInShadowTree):
(WebCore::composedTreeAsText):
(WebCore::ComposedTreeIterator::pushContext): Deleted.

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::context):
(WebCore::ComposedTreeIterator::current):
(WebCore::ComposedTreeIterator::traverseNext):
(WebCore::composedTreeChildren):

testing/Internals.cpp:

(WebCore::Internals::composedTreeAsText):

Testing support.

testing/Internals.h:
testing/Internals.idl:

LayoutTests:

fast/shadow-dom/composed-tree-basic-expected.txt: Added.
fast/shadow-dom/composed-tree-basic.html: Added.

1:12 PM Changeset in webkit [196832] by rniwa@webkit.org

3 edits in trunk/Websites/perf.webkit.org

Analysis tasks page complains about missing repository but with a wrong name
https://bugs.webkit.org/show_bug.cgi?id=154468

Reviewed by Chris Dumez.

Fixed the bug by using the right variable in the template literal.

public/v3/components/customizable-test-group-form.js:

(CustomizableTestGroupForm.prototype._computeRootSetMap): Use querySelector here since Chrome doesn't have
getElementsByClassName on ShadowRoot.

public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage.prototype._createTestGroupAfterVerifyingRootSetList): Use name which is the name of
repository here.

1:04 PM Changeset in webkit [196831] by jer.noble@apple.com

5 edits in trunk/Source/WebCore

Adopt CachedRawResourceClient::shouldCacheResponse() in MediaResourceLoader and WebCoreNSURLSession
https://bugs.webkit.org/show_bug.cgi?id=154466

Reviewed by Alex Christensen.

Adopt the new shouldCacheResponse() callback so that byte-range
requests generated by WebCoreNSURLSession are not cached.

loader/MediaResourceLoader.cpp:

(WebCore::MediaResource::shouldCacheResponse):

loader/MediaResourceLoader.h:
platform/graphics/PlatformMediaResourceLoader.h:

(WebCore::PlatformMediaResourceClient::shouldCacheResponse):

platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession downloadTaskWithRequest:]):
(-[WebCoreNSURLSession streamTaskWithHostName:port:]):
(-[WebCoreNSURLSession streamTaskWithNetService:]):
(-[WebCoreNSURLSessionDataTask _timingData]):
(-[WebCoreNSURLSessionDataTask resource:sentBytes:totalBytesToBeSent:]):

1:02 PM Changeset in webkit [196830] by Chris Dumez

4 edits in trunk/LayoutTests

Re-sync W3C web-platform-tests' html/dom/interfaces.html
https://bugs.webkit.org/show_bug.cgi?id=154463

Reviewed by Ryosuke Niwa.

Re-sync W3C web-platform-tests' html/dom/interfaces.html after:

https://github.com/w3c/web-platform-tests/pull/2588

web-platform-tests/html/dom/interfaces-expected.txt:
web-platform-tests/html/dom/interfaces.html:

12:14 PM Changeset in webkit [196829] by bshafiei@apple.com

5 edits in tags/Safari-602.1.19.1/Source

Versioning.

12:12 PM Changeset in webkit [196828] by bshafiei@apple.com

1 copy in tags/Safari-602.1.19.1

New tag.

11:46 AM Changeset in webkit [196827] by jer.noble@apple.com

5 edits in trunk/Source/WebCore

[Mac] CORS-compliant videos throw security errors when painting to Canvas
https://bugs.webkit.org/show_bug.cgi?id=154188
<rdar://problem/22959556>

Reviewed by Alex Christensen.

Pass the CORS access check results from WebCoreNSURLSession to it's client,
MediaPlayerPrivateAVFoundationObjC.

WebCore.xcodeproj/project.pbxproj:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::didPassCORSAccessCheck): Ask the WebCoreNSURLSession.

platform/network/cocoa/WebCoreNSURLSession.h:
platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession task:didReceiveCORSAccessCheckResult:]): Conditionally set _corsResults.
(-[WebCoreNSURLSession didPassCORSAccessChecks]): Return _corsResults.
(WebCoreNSURLSessionDataTaskClient::accessControlCheckFailed): Call -resource:accessControlCheckFailedWithError:.
(WebCoreNSURLSessionDataTaskClient::loadFailed): Call -resource:loadFailedWithError:.
(-[WebCoreNSURLSessionDataTask resource:receivedResponse:]): Set _response within the delegate queue.
(-[WebCoreNSURLSessionDataTask _resource:loadFinishedWithError:]): Renamed from resourceFinished:
(-[WebCoreNSURLSessionDataTask resource:accessControlCheckFailedWithError:]): Ditto.
(-[WebCoreNSURLSessionDataTask resource:loadFailedWithError:]): Ditto.
(-[WebCoreNSURLSessionDataTask resourceFinished:]): Ditto.

11:12 AM Changeset in webkit [196826] by Chris Dumez

2 edits in trunk/Source/WebCore

Unreviewed build fix.

loader/cocoa/SubresourceLoaderCocoa.mm:

(WebCore::SubresourceLoader::willCacheResponse):

11:06 AM Changeset in webkit [196825] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/Source/WebCore

Merge r196703. rdar://problem/24623986

10:58 AM Changeset in webkit [196824] by n_wang@apple.com

8 edits in trunk

AX: Inconsistency between CharacterOffset and VisiblePostition
https://bugs.webkit.org/show_bug.cgi?id=154431

Reviewed by Chris Fleizach.

Source/WebCore:

VoiceOver is not getting the correct text marker from VisiblePostition when
navigating using arrow keys. We should make the CharacterOffset behavior consistent
with VisiblePosition so that the conversion between the two won't create different
text markers.

Changes are covered in the modified tests.

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::characterOffsetForTextMarkerData):
(WebCore::AXObjectCache::traverseToOffsetInRange):
(WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
(WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
(WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
(WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
(WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):
(WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
(WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
(WebCore::AXObjectCache::accessibilityObjectForTextMarkerData):
(WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
(WebCore::AXObjectCache::nextCharacterOffset):
(WebCore::AXObjectCache::previousCharacterOffset):
(WebCore::AXObjectCache::startCharacterOffsetOfWord):
(WebCore::AXObjectCache::endCharacterOffsetOfWord):
(WebCore::AXObjectCache::previousWordStartCharacterOffset):
(WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
(WebCore::AXObjectCache::previousSentenceStartCharacterOffset):

accessibility/AXObjectCache.h:
accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):

LayoutTests:

accessibility/mac/text-marker-word-nav-expected.txt:
accessibility/mac/text-marker-word-nav.html:
accessibility/text-marker/text-marker-previous-next.html:

10:06 AM Changeset in webkit [196823] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Purge as much as we can from WKDeprecatedFunctions.cpp
https://bugs.webkit.org/show_bug.cgi?id=154459

Reviewed by Sam Weinig.

Shared/API/c/WKDeprecatedFunctions.cpp:

(WKArrayIsMutable): Deleted.
(WKPageSetVisibilityState): Deleted.
(WKDictionaryIsMutable): Deleted.
(WKDictionaryAddItem): Deleted.
(WKDictionaryRemoveItem): Deleted.
(WKPreferencesSetRegionBasedColumnsEnabled): Deleted.
(WKPreferencesGetRegionBasedColumnsEnabled): Deleted.
(WKPreferencesSetMultithreadedWebGLEnabled): Deleted.
(WKPreferencesGetMultithreadedWebGLEnabled): Deleted.
(WKPreferencesSetScreenFontSubstitutionEnabled): Deleted.
(WKPreferencesGetScreenFontSubstitutionEnabled): Deleted.
(WKInspectorIsDebuggingJavaScript): Deleted.
(WKInspectorToggleJavaScriptDebugging): Deleted.
(WKInspectorIsProfilingJavaScript): Deleted.
(WKInspectorToggleJavaScriptProfiling): Deleted.
(WKContextGetProcessModel): Deleted.
(WKGraphicsContextGetCGContext): Deleted.
(WKContextGetProcessSuppressionEnabled): Deleted.
(WKContextSetProcessSuppressionEnabled): Deleted.

10:05 AM Changeset in webkit [196822] by jer.noble@apple.com

6 edits in trunk/Source/WebCore

Allow CachedRawResource clients to opt out of caching on a per-response basis
https://bugs.webkit.org/show_bug.cgi?id=154453

Reviewed by Brady Eidson.

For CF or NS networking clients, the system loader will ask whether the client (the
SubResourceLoader in this case) wants the response to be cached. This breaks for byte
range requests due to <rdar://problem/20001985>. Allow the SubresourceLoader to query
its clients, and return null, if they opt out.

loader/cache/CachedRawResource.cpp:

(WebCore::CachedRawResource::shouldCacheResponse):

loader/cache/CachedRawResource.h:
loader/cache/CachedRawResourceClient.h:

(WebCore::CachedRawResourceClient::shouldCacheResponse):

loader/cache/CachedResource.h:

(WebCore::CachedResource::shouldCacheResponse):

loader/cocoa/SubresourceLoaderCocoa.mm:

(WebCore::SubresourceLoader::willCacheResponse):

9:35 AM Changeset in webkit [196821] by beidson@apple.com

11 edits in trunk

Add "databaseProcessDidCrash" to the WKContextClient; Adopt it in WKTR.
https://bugs.webkit.org/show_bug.cgi?id=154428

Reviewed by Jer Noble.

Source/WebKit2:

UIProcess/API/C/WKContext.h:
UIProcess/API/C/mac/WKContextPrivateMac.h:
UIProcess/API/C/mac/WKContextPrivateMac.mm:

(WKContextGetDatabaseProcessIdentifier):

UIProcess/WebContextClient.cpp:

(WebKit::WebContextClient::databaseProcessDidCrash):

UIProcess/WebContextClient.h:

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::databaseProcessCrashed):
(WebKit::WebProcessPool::databaseProcessIdentifier):

UIProcess/WebProcessPool.h:

Tools:

WebKitTestRunner/TestController.cpp:

(WTR::TestController::generatePageConfiguration):
(WTR::TestController::databaseProcessName):
(WTR::TestController::databaseProcessDidCrash):

WebKitTestRunner/TestController.h:

8:49 AM Changeset in webkit [196820] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196797

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

5:25 AM Changeset in webkit [196819] by jfernandez@igalia.com

50 edits
6 adds in trunk/LayoutTests

[CSS Grid Layout Refactoring some layout tests
https://bugs.webkit.org/show_bug.cgi?id=154291

Refactored several tests so they use the shared sizing keywords
instead of specific CSS rules.

Reviewed by Sergio Villar Senin.

fast/css-grid-layout/calc-resolution-grid-item.html:
fast/css-grid-layout/flex-and-intrinsic-sizes-expected.txt:
fast/css-grid-layout/flex-and-intrinsic-sizes.html:
fast/css-grid-layout/grid-align-justify-margin-border-padding-vertical-lr.html:
fast/css-grid-layout/grid-align-justify-margin-border-padding-vertical-rl.html:
fast/css-grid-layout/grid-align-justify-margin-border-padding.html:
fast/css-grid-layout/grid-align-justify-overflow.html:
fast/css-grid-layout/grid-align-justify-stretch.html:
fast/css-grid-layout/grid-align.html:
fast/css-grid-layout/grid-columns-rows-get-set-multiple.html:
fast/css-grid-layout/grid-columns-rows-get-set.html:
fast/css-grid-layout/grid-container-margin-border-padding-scrollbar.html:
fast/css-grid-layout/grid-content-alignment-and-self-alignment.html:
fast/css-grid-layout/grid-content-alignment-overflow.html:
fast/css-grid-layout/grid-content-alignment-with-span-vertical-lr.html:
fast/css-grid-layout/grid-content-alignment-with-span-vertical-rl.html:
fast/css-grid-layout/grid-content-alignment-with-span.html:
fast/css-grid-layout/grid-element-change-columns-repaint.html:
fast/css-grid-layout/grid-element-change-rows-repaint.html:
fast/css-grid-layout/grid-element-repeat-get-set.html:
fast/css-grid-layout/grid-gutters-and-alignment.html:
fast/css-grid-layout/grid-item-auto-margins-alignment-vertical-lr.html:
fast/css-grid-layout/grid-item-auto-margins-alignment-vertical-rl.html:
fast/css-grid-layout/grid-item-auto-margins-alignment.html:
fast/css-grid-layout/grid-item-auto-margins-and-stretch.html:
fast/css-grid-layout/grid-item-auto-sized-align-justify-margin-border-padding.html:
fast/css-grid-layout/grid-item-change-column-repaint.html:
fast/css-grid-layout/grid-item-order-paint-order.html:
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding-expected.txt: Added.
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding-vertical-lr-expected.txt: Added.
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding-vertical-lr.html: Added.
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding-vertical-rl-expected.txt: Added.
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding-vertical-rl.html: Added.
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding.html: Added.
fast/css-grid-layout/grid-item-z-index-stacking-context-expected.html:
fast/css-grid-layout/grid-item-z-index-stacking-context.html:
fast/css-grid-layout/grid-items-should-not-be-stretched-when-height-or-width-or-margin-change.html:
fast/css-grid-layout/grid-justify-content-distribution.html:
fast/css-grid-layout/grid-justify-content-vertical-lr.html:
fast/css-grid-layout/grid-justify-content-vertical-rl.html:
fast/css-grid-layout/justify-self-cell.html:
fast/css-grid-layout/min-width-height-auto-and-margins.html:
fast/css-grid-layout/minmax-fixed-logical-height-only.html:
fast/css-grid-layout/minmax-fixed-logical-width-only.html:
fast/css-grid-layout/minmax-max-content-resolution-columns.html:
fast/css-grid-layout/minmax-max-content-resolution-rows.html:
fast/css-grid-layout/named-grid-line-get-set.html:
fast/css-grid-layout/percent-grid-item-in-percent-grid-track-in-percent-grid.html:
fast/css-grid-layout/percent-grid-item-in-percent-grid-track.html:
fast/css-grid-layout/percent-of-indefinite-track-size-in-auto.html:
fast/css-grid-layout/percent-of-indefinite-track-size.html:
fast/css-grid-layout/percent-track-breadths-regarding-container-size.html:
fast/css-grid-layout/place-cell-by-index.html:
fast/css-grid-layout/resources/grid-alignment.css:

(.alignSelfCenterSafe):
(.alignSelfCenterUnsafe):
(.alignSelfEndSafe):
(.alignSelfEndUnsafe):
(.alignItemsAuto):
(.alignItemsStretch):
(.alignItemsStart):
(.alignItemsEnd):
(.alignItemsCenterSafe):
(.alignItemsCenterUnsafe):
(.alignItemsEndSafe):
(.alignItemsEndUnsafe):
(.justifySelfAuto):
(.justifySelfStretch):
(.justifySelfStart):
(.justifySelfCenter):
(.justifySelfEnd):
(.justifySelfRight):
(.justifySelfLeft):
(.justifySelfFlexStart):
(.justifySelfFlexEnd):
(.justifySelfSelfStart):
(.justifySelfSelfEnd):
(.justifySelfCenterSafe):
(.justifySelfCenterUnsafe):
(.justifyItemsAuto):
(.justifyItemsStretch):
(.justifyItemsStart):
(.justifyItemsCenter):
(.justifyItemsEnd):
(.justifyItemsCenterSafe):
(.justifyItemsCenterUnsafe):
(.justifyItemsEndSafe):
(.justifyItemsEndUnsafe):
(.selfStretch):
(.contentStart):
(.contentCenter):
(.contentEnd):
(.contentCenterSafe):
(.contentCenterUnsafe):
(.contentEndSafe):
(.contentEndUnsafe):
(.contentSpaceBetween):
(.contentSpaceAround):
(.contentSpaceEvenly):
(.contentStretch):

fast/css-grid-layout/resources/grid.css:

(.verticalRL):
(.verticalLR):
(.horizontalTB):
(.horizontalBT):
(.inline-grid): Deleted.
(.firstRowFirstColumn): Deleted.
(.directionRTL): Deleted.

5:13 AM Changeset in webkit [196818] by Carlos Garcia Campos

1 copy in releases/WebKitGTK/webkit-2.11.90

WebKitGTK+ 2.11.90

5:11 AM Changeset in webkit [196817] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.11.90 release.

Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

gtk/NEWS: Add release notes for 2.11.90.

4:11 AM Changeset in webkit [196816] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r196810 - Add isJSString(JSCell*) variant to avoid Cell->JSValue->Cell conversion
https://bugs.webkit.org/show_bug.cgi?id=154442

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-19
Reviewed by Saam Barati.

runtime/JSString.h:

(JSC::isJSString):

3:56 AM Changeset in webkit [196815] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r196809 - [GStreamer] clean-up various leaks
https://bugs.webkit.org/show_bug.cgi?id=154285

Reviewed by Carlos Garcia Campos.

platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:

(webkit_web_audio_src_init): Take full ownership of the GstTask.

platform/graphics/gstreamer/GRefPtrGStreamer.cpp:

(WTF::adoptGRef): Null pointer support in ASSERTs.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::initializeGStreamerAndRegisterWebKitElements): Take full ownership of the GstElementFactory pointers.
(WebCore::MediaPlayerPrivateGStreamer::isAvailable): Ditto.

3:55 AM Changeset in webkit [196814] by Carlos Garcia Campos

5 edits
2 moves in releases/WebKitGTK/webkit-2.12

Merge r196807 - Revert to dispatching the popstate event synchronously
https://bugs.webkit.org/show_bug.cgi?id=153297
rdar://problem/24092294

Reviewed by Brent Fulgham.

Source/WebCore:

r192369 made the popstate event dispatch asynchronously, which matches what the HTML5 spec says to do. However,
due to compatibility regressions we need to revert back to dispatching synchronously. This change reverts
r192369's changes to Document.cpp, but retains the new tests.

Firing popstate synchronously makes both fast/loader/remove-iframe-during-history-navigation-different.html and
fast/loader/remove-iframe-during-history-navigation-same.html crash, because their onpopstate handlers remove
frames from the document that will later be accessed by HistoryController::recursiveGoToItem().

To prevent the crashes, this change does two things:

Keep a reference to the current frame inside FrameLoader::loadSameDocumentItem(), since calling loadInSameDocument() might otherwise delete it.
Handle a null frame when iterating a HistoryItem's child frames in HistoryController::recursiveGoToItem(), since calling goToItem() on one frame might cause another frame to be deleted.

Covered by existing tests. fast/loader/stateobjects/popstate-is-asynchronous.html was renamed to
fast/loader/stateobjects/popstate-is-synchronous.html and modified to expect synchronous dispatch.

dom/Document.cpp:

(WebCore::Document::enqueuePopstateEvent):

loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadSameDocumentItem):

loader/HistoryController.cpp:

(WebCore::HistoryController::recursiveGoToItem):

LayoutTests:

Renamed and modified this test to expect synchronous dispatch.

fast/loader/stateobjects/popstate-is-synchronous-expected.txt: Renamed from LayoutTests/fast/loader/stateobjects/popstate-is-asynchronous-expected.txt.
fast/loader/stateobjects/popstate-is-synchronous.html: Renamed from LayoutTests/fast/loader/stateobjects/popstate-is-asynchronous.html.

3:48 AM Changeset in webkit [196813] by Alan Bujtas

3 edits in trunk/Source/WebCore

Blocked plug-in placeholder is sometimes not shown.
https://bugs.webkit.org/show_bug.cgi?id=154434
<rdar://problem/22584973>

Reviewed by Brent Fulgham.

Unable to test.

rendering/RenderEmbeddedObject.cpp:

rendering/RenderEmbeddedObject.h:

(WebCore::RenderEmbeddedObject::showsUnavailablePluginIndicator):

3:30 AM Changeset in webkit [196812] by Csaba Osztrogonác

3 edits
3 deletes in trunk/Source/JavaScriptCore

Remove more LLVM related dead code after r196729
https://bugs.webkit.org/show_bug.cgi?id=154387

Reviewed by Filip Pizlo.

Configurations/CompileRuntimeToLLVMIR.xcconfig: Removed.
Configurations/LLVMForJSC.xcconfig: Removed.
JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.props: Removed.
JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj: Removed.
JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj.filters: Removed.
JavaScriptCore.xcodeproj/project.pbxproj:
disassembler/X86Disassembler.cpp:

2:49 AM Changeset in webkit [196811] by Csaba Osztrogonác

3 edits in trunk/Source/WebCore

Fix pessimizing-move warnings
https://bugs.webkit.org/show_bug.cgi?id=154395

Reviewed by Michael Catanzaro.

platform/graphics/efl/CairoUtilitiesEfl.cpp:

(WebCore::evasObjectFromCairoImageSurface):

platform/graphics/surfaces/GLTransportSurface.cpp:

(WebCore::GLTransportSurface::createTransportSurface):
(WebCore::GLTransportSurfaceClient::createTransportSurfaceClient):

2:39 AM Changeset in webkit [196810] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

Add isJSString(JSCell*) variant to avoid Cell->JSValue->Cell conversion
https://bugs.webkit.org/show_bug.cgi?id=154442

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-19
Reviewed by Saam Barati.

runtime/JSString.h:

(JSC::isJSString):

2:30 AM Changeset in webkit [196809] by Philippe Normand

4 edits in trunk/Source/WebCore

[GStreamer] clean-up various leaks
https://bugs.webkit.org/show_bug.cgi?id=154285

Reviewed by Carlos Garcia Campos.

platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:

(webkit_web_audio_src_init): Take full ownership of the GstTask.

platform/graphics/gstreamer/GRefPtrGStreamer.cpp:

(WTF::adoptGRef): Null pointer support in ASSERTs.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::initializeGStreamerAndRegisterWebKitElements): Take full ownership of the GstElementFactory pointers.
(WebCore::MediaPlayerPrivateGStreamer::isAvailable): Ditto.

2:17 AM Changeset in webkit [196808] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

Remove unused SymbolTable::createNameScopeTable
https://bugs.webkit.org/show_bug.cgi?id=154443

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-19
Reviewed by Saam Barati.

runtime/SymbolTable.h:

1:29 AM Changeset in webkit [196807] by aestes@apple.com

5 edits
2 moves in trunk

Revert to dispatching the popstate event synchronously
https://bugs.webkit.org/show_bug.cgi?id=153297
rdar://problem/24092294

Reviewed by Brent Fulgham.

Source/WebCore:

To prevent the crashes, this change does two things:

Keep a reference to the current frame inside FrameLoader::loadSameDocumentItem(), since calling loadInSameDocument() might otherwise delete it.
Handle a null frame when iterating a HistoryItem's child frames in HistoryController::recursiveGoToItem(), since calling goToItem() on one frame might cause another frame to be deleted.

Covered by existing tests. fast/loader/stateobjects/popstate-is-asynchronous.html was renamed to
fast/loader/stateobjects/popstate-is-synchronous.html and modified to expect synchronous dispatch.

dom/Document.cpp:

(WebCore::Document::enqueuePopstateEvent):

loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadSameDocumentItem):

loader/HistoryController.cpp:

(WebCore::HistoryController::recursiveGoToItem):

LayoutTests:

Renamed and modified this test to expect synchronous dispatch.

fast/loader/stateobjects/popstate-is-synchronous-expected.txt: Renamed from LayoutTests/fast/loader/stateobjects/popstate-is-asynchronous-expected.txt.
fast/loader/stateobjects/popstate-is-synchronous.html: Renamed from LayoutTests/fast/loader/stateobjects/popstate-is-asynchronous.html.

1:00 AM WebKitGTK/2.12.x created by Carlos Garcia Campos

12:56 AM Changeset in webkit [196806] by Carlos Garcia Campos

1 copy in releases/WebKitGTK/webkit-2.12

Branch WebKitGTK+ for 2.12

12:47 AM Changeset in webkit [196805] by Carlos Garcia Campos

2 edits in trunk/Source/WebCore

Unreviewed. Fix GObject DOM bindings API break after r196769.

html/HTMLTextAreaElement.idl:

12:09 AM Changeset in webkit [196804] by Philippe Normand

6 edits
3 deletes in trunk

[GStreamer] Bump internal jhbuild versions to 1.6.3
https://bugs.webkit.org/show_bug.cgi?id=149594

Reviewed by Michael Catanzaro.

Source/cmake/FindGStreamer.cmake: Check gst-gl version for the latest stable release of GStreamer.

Tools:

gtk/jhbuild.modules: Bump to GStreamer 1.6.3.
gtk/patches/gst-plugins-bad-fix-faad2-version-check.patch: Removed.
gtk/patches/gst-plugins-bad-remove-gnustep-support.patch: Removed.
gtk/patches/gst-plugins-base-rtp-rtcpbuffer-fix-typo-in-enum.patch: Removed.

LayoutTests:

platform/gtk/TestExpectations: Skipping new failing tests for now.

Feb 18, 2016:

11:27 PM Changeset in webkit [196803] by yoon@igalia.com

7 edits in trunk/Source

[GTK] Limit the number of tiles according to the visible area
https://bugs.webkit.org/show_bug.cgi?id=126122

Reviewed by Carlos Garcia Campos.

Source/WebCore:

This patch modifies TextureMapperTiledBackingStore to take into account the
visible area with a coverage multiplier when creating tiles.

platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:

platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:

Source/WebKit2:

WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:

11:22 PM Changeset in webkit [196802] by Brent Fulgham

7 edits
1 add in trunk

Extend HashCountedSet with a method to efficiently set the count of an entry
https://bugs.webkit.org/show_bug.cgi?id=154352

Reviewed by Geoffrey Garen.

Source/WebCore:

Tested by new TestWebKitAPI tests.

loader/ResourceLoadStatistics.cpp:

(WebCore::decodeHashCountedSet): Update to use new HashCountedSet::add method.

Source/WTF:

Tested by new TestWebKitAPI tests.

Update the HashCountedSet class with a new 'add' method to support efficient initialization of
the count of a given key. Also provide move and pointer template specializations to expand the
types of data that can be used as 'keys' in the HashCountedSet to match the underlying HashMap
implementation.

wtf/HashCountedSet.h:

(WTF::Traits>::add): Added new overload supporting a supplied count.

Tools:

TestWebKitAPI/CMakeLists.txt: Add new HashCountedSet test files.
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Ditto.
TestWebKitAPI/Tests/WTF/HashCountedSet.cpp: Added.

11:14 PM WebKitGTK/GRefPtrAndFloatingRefs created by Carlos Garcia Campos

10:56 PM Changeset in webkit [196801] by commit-queue@webkit.org

3 edits
2 deletes in trunk

Unreviewed, rolling out r196790.
https://bugs.webkit.org/show_bug.cgi?id=154439

made fast/events/wheelevent-basic-actual.txt fail in WK2
(Requested by alexchristensen on #webkit).

Reverted changeset:

"Wheel event callback removing the window causes crash in
WebCore."
https://bugs.webkit.org/show_bug.cgi?id=150871
http://trac.webkit.org/changeset/196790

10:53 PM Changeset in webkit [196800] by commit-queue@webkit.org

7 edits
1 delete in trunk

Unreviewed, rolling out r196791.
https://bugs.webkit.org/show_bug.cgi?id=154438

broke windows build (Requested by alexchristensen on #webkit).

Reverted changeset:

"Extend HashCountedSet with a method to efficiently set the
count of an entry"
https://bugs.webkit.org/show_bug.cgi?id=154352
http://trac.webkit.org/changeset/196791

10:42 PM Changeset in webkit [196799] by commit-queue@webkit.org

8 edits in trunk/Source/JavaScriptCore

[JSC] Improve the instruction selection of Select
https://bugs.webkit.org/show_bug.cgi?id=154432

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-18
Reviewed by Filip Pizlo.

Plenty of code but this patch is pretty dumb:
-On ARM64: use the 3 operand form of CSEL instead of forcing a source

to be alised to the destination. This gives more freedom to the register
allocator and it is one less Move to process per Select.

-On x86, introduce a fake 3 operands form and use aggressive aliasing

to try to alias both sources to the destination.

If aliasing succeed on the "elseCase", the condition of the Select
is reverted in the MacroAssembler.

If no aliasing is possible and we end up with 3 registers, the missing
move instruction is generated by the MacroAssembler.

The missing move is generated after testing the values because the destination
can use the same register as one of the test operand.
Experimental testing seems to indicate there is no macro-fusion on CMOV,
there is no measurable cost to having the move there.

assembler/MacroAssembler.h:

(JSC::MacroAssembler::isInvertible):
(JSC::MacroAssembler::invert):

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::moveConditionallyDouble):
(JSC::MacroAssemblerARM64::moveConditionallyFloat):
(JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
(JSC::MacroAssemblerARM64::moveConditionally32):
(JSC::MacroAssemblerARM64::moveConditionally64):
(JSC::MacroAssemblerARM64::moveConditionallyTest32):
(JSC::MacroAssemblerARM64::moveConditionallyTest64):

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::moveConditionallyDouble):
(JSC::MacroAssemblerX86Common::moveConditionallyFloat):
(JSC::MacroAssemblerX86Common::moveConditionally32):
(JSC::MacroAssemblerX86Common::moveConditionallyTest32):
(JSC::MacroAssemblerX86Common::invert):
(JSC::MacroAssemblerX86Common::isInvertible):

assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::moveConditionally64):
(JSC::MacroAssemblerX86_64::moveConditionallyTest64):

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::createSelect):
(JSC::B3::Air::LowerToAir::lower):

b3/air/AirInstInlines.h:

(JSC::B3::Air::Inst::shouldTryAliasingDef):

b3/air/AirOpcode.opcodes:

9:26 PM Changeset in webkit [196798] by commit-queue@webkit.org

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Styles Sidebar focus jumps when trying to edit a color
https://bugs.webkit.org/show_bug.cgi?id=154404
<rdar://problem/24725744>

Patch by Devin Rousso <Devin Rousso> on 2016-02-18
Reviewed by Timothy Hatcher.

Clicking an inline swatch in the CSS Rules sidebar causes any focused
editor, if any, to become blurred and therefore fire its handler function.
This causes an issue because when a CodeMirror instance in the styles
sidebar becomes blurred, it is possible for the entire Rules sidebar to
refresh and recreate all of the sections (r187714), meaning that it will
reselect whatever editor was previously selected before the refresh,
causing the swatch popup to be blurred and therefore dismiss.

UserInterface/Views/CSSStyleDeclarationSection.js:

(WebInspector.CSSStyleDeclarationSection.prototype.cssStyleDeclarationTextEditorBlurActiveEditor):

UserInterface/Views/CSSStyleDeclarationTextEditor.js:

(WebInspector.CSSStyleDeclarationTextEditor.prototype._createInlineSwatches.createSwatch):
(WebInspector.CSSStyleDeclarationTextEditor.prototype._inlineSwatchBeforeClicked):
Add listener for new event and call to delegate function for handling it.

UserInterface/Views/InlineSwatch.js:

(WebInspector.InlineSwatch.prototype._swatchElementClicked):
Now fires an event before the clicked logic happens, but still after the
click event is fired on the element.

UserInterface/Views/RulesStyleDetailsPanel.js:

(WebInspector.RulesStyleDetailsPanel.prototype.cssStyleDeclarationSectionBlurActiveEditor):
Clears the previously focused editor so when a reset happens no editor
is refocused.

9:17 PM Changeset in webkit [196797] by Chris Dumez

15 edits in trunk

window.history / window.navigator should not be replaceable
https://bugs.webkit.org/show_bug.cgi?id=154412

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

window.history / window.navigator should not be replaceable as per
the latest HTML specification:
https://html.spec.whatwg.org/multipage/browsers.html#the-window-object

Firefox and Chrome already match the specification. This patch aligns
our behavior.

No new tests, already covered by existing tests.

page/DOMWindow.idl:

LayoutTests:

Update / rebaseline existing tests now that window.history and
window.navigator are no longer replaceable.

fast/dom/Window/get-set-properties-expected.txt:
fast/dom/Window/get-set-properties.html:
fast/dom/Window/window-property-shadowing-expected.txt:
fast/dom/Window/window-property-shadowing.html:
http/tests/history/cross-origin-replace-history-object-child-expected.txt:
http/tests/history/resources/cross-origin-replaces-history-object-child-iframe.html:
js/dom/var-declarations-shadowing-expected.txt:
js/dom/var-declarations-shadowing.html:
js/getOwnPropertyDescriptor-window-attributes-expected.txt:
js/getOwnPropertyDescriptor-window-attributes.html:

9:12 PM Changeset in webkit [196796] by Gyuyoung Kim

2 edits in trunk/Source/JavaScriptCore

[CMake][GTK] Clean up llvm guard in PlatformGTK.cmake
https://bugs.webkit.org/show_bug.cgi?id=154430

Reviewed by Saam Barati.

llvm isn't used anymore.

PlatformGTK.cmake: Remove USE_LLVM_DISASSEMBLER guard.

8:25 PM Changeset in webkit [196795] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

Revert an unintended change made in the previous commit.

init-database.sql:

8:18 PM Changeset in webkit [196794] by rniwa@webkit.org

8 edits in trunk/Websites/perf.webkit.org

Perf dashboard should let user cancel pending A/B testing and hide failed ones
https://bugs.webkit.org/show_bug.cgi?id=154433

Reviewed by Chris Dumez.

Added a button to hide a test group in the details view (the bottom table) in the analysis task page, and
"Show hidden tests" link to show the hidden test groups on demand. When a test group is hidden, all pending
requests in the group will also be canceled since a common scenario of using this feature is that the user
had triggered an useless A/B testing; e.g. all builds will fail, wrong, etc... We can revisit and add the
capability to just cancel the pending requests and leaving the group visible later if necessary.

Run ALTER TYPE build_request_status_type ADD VALUE 'canceled'; to add the new type.

init-database.sql: Added testgroup_hidden column to analysis_test_groups table and added 'canceled'

as a value to build_request_status_type table.

public/api/test-groups.php:

(format_test_group): Added 'hidden' field in the JSON result.

public/privileged-api/update-test-group.php:

(main): Added the support for updating testgroup_hidden column. When this column is set to true, also
cancel all pending build requests (by setting its request_status to 'canceled' which will be ignore by
the syncing script).

public/v3/components/test-group-results-table.js:

(TestGroupResultsTable.prototype.setTestGroup): Reset _renderedTestGroup here so that the next call to
render() will update the table; e.g. when build requests' status change from 'Pending' to 'Canceled'.

public/v3/models/build-request.js:

(BuildRequest.prototype.hasCompleted): A build request is considered complete/finished if it's canceled.
(BuildRequest.prototype.hasPending): Added.
(BuildRequest.prototype.statusLabel): Handle 'canceled' status.

public/v3/models/test-group.js:

(TestGroup):
(TestGroup.prototype.updateSingleton): Added to update 'hidden' field.
(TestGroup.prototype.isHidden): Added.
(TestGroup.prototype.hasPending): Added.
(TestGroup.prototype.hasPending): Added.
(TestGroup.prototype.updateHiddenFlag): Added. Uses the privileged API to update testgroup_hidden column.
The JSON API also updates the status of the 'pending' build requests in the group to 'canceled'.

public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage): Added _showHiddenTestGroups and _filteredTestGroups as instance variables.
(AnalysisTaskPage.prototype._didFetchTestGroups):
(AnalysisTaskPage.prototype._showAllTestGroups): Added.
(AnalysisTaskPage.prototype._didUpdateTestGroupHiddenState): Extracted from _didFetchTestGroups.
(AnalysisTaskPage.prototype._renderTestGroupList): Use the filtered list of test groups to show the list
of test groups. When all test groups are shown, we would first show the hidden ones after the regular ones.
(AnalysisTaskPage.prototype._createTestGroupListItem): Extracted from _renderTestGroupList.
(AnalysisTaskPage.prototype._renderTestGroupDetails): Update the text inside the button to hide the test
group. Also show a warning text that the pending requests will be canceled if there are any.
(AnalysisTaskPage.prototype._hideCurrentTestGroup): Added.
(AnalysisTaskPage.cssTemplate): Updated the style.

6:45 PM Changeset in webkit [196793] by Chris Dumez

10 edits
1 copy in trunk

HTMLTableHeaderCellElement.scope should only return known values
https://bugs.webkit.org/show_bug.cgi?id=154423
<rdar://problem/24731018>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/reflection-tabular-expected.txt:

Source/WebCore:

HTMLTableHeaderCellElement.scope should only return known values as per:

https://html.spec.whatwg.org/multipage/tables.html#dom-th-scope

Known values are document here:

https://html.spec.whatwg.org/multipage/tables.html#attr-th-scope

No new tests, already covered by existing test.

CMakeLists.txt:
WebCore.vcxproj/WebCore.vcxproj:
WebCore.vcxproj/WebCore.vcxproj.filters:
WebCore.xcodeproj/project.pbxproj:
html/HTMLElementsAllInOne.cpp:
html/HTMLTableHeaderCellElement.cpp: Copied from Source/WebCore/html/HTMLTableHeaderCellElement.h.

(WebCore::HTMLTableHeaderCellElement::scope):
(WebCore::HTMLTableHeaderCellElement::setScope):

html/HTMLTableHeaderCellElement.h:
html/HTMLTableHeaderCellElement.idl:

6:44 PM Changeset in webkit [196792] by rniwa@webkit.org

4 edits in trunk/Websites/perf.webkit.org

The rows in the analysis results table should be expandable
https://bugs.webkit.org/show_bug.cgi?id=154427

Reviewed by Chris Dumez.

Added "(Expand)" link between rows that have hidden points. Upon click it inserts the hidden rows.

We insert around five rows at a time when there are hundreds of hidden points but we also avoid leaving
behind expandable rows of less than two rows.

Also fixed a bug in CustomizableTestGroupForm that getElementsById would throw in the shipping Safari
because getElementsById doesn't exist on Element.prototype by using class name instead.

public/v3/components/analysis-results-viewer.js:

(AnalysisResultsViewer):
(AnalysisResultsViewer.prototype.setCurrentTestGroup): Removed superfluous call to render().
(AnalysisResultsViewer.prototype.setPoints): Always show the start and the end points.
(AnalysisResultsViewer.prototype.buildRowGroups):
(AnalysisResultsViewer.prototype._buildRowsForPointsAndTestGroups): Add an instance of ExpandableRow which
shows a "(Expand)" link to show hidden rows here.
(AnalysisResultsViewer.prototype._expandBetween): Added. Expands rows between two points.
(AnalysisResultsViewer.cssTemplate): Added rules for "(Expand)" links.
(AnalysisResultsViewer.ExpandableRow): Added.
(AnalysisResultsViewer.ExpandableRow.prototype.resultContent): Added. Overrides what's in the results column.
(AnalysisResultsViewer.ExpandableRow.prototype.heading): Added. Generates "(Expand)" link.

public/v3/components/customizable-test-group-form.js:

(CustomizableTestGroupForm.prototype._computeRootSetMap): Use getElementsByClassName instead of
getElementById.
(CustomizableTestGroupForm.prototype._classForLabelAndRepository): Renamed from _idForLabelAndRepository.
(CustomizableTestGroupForm._constructRevisionRadioButtons): Set class name instead of id.

public/v3/components/results-table.js:

(ResultsTable.prototype.render): Don't generate radio buttons to select a row when root set is missing;
e.g. for rows that show "(Expand)" links.

5:14 PM Changeset in webkit [196791] by Brent Fulgham

7 edits
1 add in trunk

Extend HashCountedSet with a method to efficiently set the count of an entry
https://bugs.webkit.org/show_bug.cgi?id=154352

Reviewed by Geoffrey Garen.

Source/WebCore:

Tested by new TestWebKitAPI tests.

loader/ResourceLoadStatistics.cpp:

(WebCore::decodeHashCountedSet): Update to use new HashCountedSet::add method.

Source/WTF:

Tested by new TestWebKitAPI tests.

wtf/HashCountedSet.h:

(WTF::Traits>::add): Added new overload supporting a supplied count.

Tools:

TestWebKitAPI/CMakeLists.txt: Add new HashCountedSet test files.
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Ditto.
TestWebKitAPI/Tests/WTF/HashCountedSet.cpp: Added.

5:13 PM Changeset in webkit [196790] by Simon Fraser

3 edits
2 adds in trunk

Wheel event callback removing the window causes crash in WebCore.
https://bugs.webkit.org/show_bug.cgi?id=150871

Reviewed by Brent Fulgham.
Source/WebCore:

Null check the FrameView before using it, since the iframe may have been removed
from its parent document inside the event handler.

Test: fast/events/wheel-event-destroys-frame.html

page/mac/EventHandlerMac.mm:

(WebCore::EventHandler::platformCompleteWheelEvent):

LayoutTests:

fast/events/wheel-event-destroys-frame-expected.txt: Added.
fast/events/wheel-event-destroys-frame.html: Added.

5:07 PM Changeset in webkit [196789] by sbarati@apple.com

5 edits
1 add in trunk/Source/JavaScriptCore

Implement Proxy.HasProperty
https://bugs.webkit.org/show_bug.cgi?id=154313

Reviewed by Filip Pizlo.

This patch is a straight forward implementation of
Proxy.HasProperty with respect to section 9.5.7
of the ECMAScript spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p

runtime/ProxyObject.cpp:

(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::getOwnPropertySlotCommon):

runtime/ProxyObject.h:
tests/es6.yaml:
tests/stress/proxy-basic.js:

(assert):
(let.handler.has):

tests/stress/proxy-has-property.js: Added.

(assert):
(throw.new.Error.let.handler.get has):
(throw.new.Error):
(assert.let.handler.has):
(let.handler.has):
(getOwnPropertyDescriptor):
(i.catch):

5:03 PM Changeset in webkit [196788] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Add Native Parameter Lists to Console prototype functions
https://bugs.webkit.org/show_bug.cgi?id=154419
<rdar://problem/24730314>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-18
Reviewed by Timothy Hatcher.

UserInterface/Models/NativeFunctionParameters.js:

4:51 PM Changeset in webkit [196787] by rniwa@webkit.org

3 edits in trunk/Websites/perf.webkit.org

Statistically significant A/B testing results should be color coded in details view
https://bugs.webkit.org/show_bug.cgi?id=154414

Reviewed by Chris Dumez.

Color code the statistically significant comparisions in TestGroupResultsTable as done in the analysis
results viewer.

public/v3/components/customizable-test-group-form.js:

(CustomizableTestGroupForm.cssTemplate): Build fix after r196768.

public/v3/components/test-group-results-table.js:

(TestGroupResultsTable.prototype.buildRowGroups): Add the status as a class name.
(TestGroupResultsTable.cssTemplate): Added styles to color-code statistically significant results.

4:42 PM Changeset in webkit [196786] by beidson@apple.com

5 edits in trunk/Source

Modern IDB: Fix IDBGetResult encoder/decoder.
https://bugs.webkit.org/show_bug.cgi?id=154421

Reviewed by Alex Christensen.

No new tests, as Modern IDB is still disabled for WK2.

But if you manually enable it, "Basic IndexedDB Seems To Work"

Source/WebCore:

Modules/indexeddb/IDBGetResult.h:

(WebCore::IDBGetResult::encode):
(WebCore::IDBGetResult::decode):

Source/WebKit2:

Shared/WebCoreArgumentCoders.cpp:

(IPC::ArgumentCoder<IDBGetResult>::encode): Deleted.
(IPC::ArgumentCoder<IDBGetResult>::decode): Deleted.

Shared/WebCoreArgumentCoders.h:

4:27 PM Changeset in webkit [196785] by sbarati@apple.com

7 edits in trunk/Source/JavaScriptCore

Proxy's don't properly handle Symbols as PropertyKeys.
https://bugs.webkit.org/show_bug.cgi?id=154385

Reviewed by Mark Lam and Yusuke Suzuki.

We were converting all PropertyKeys to strings, even when
the PropertyName was a Symbol. In the spec, PropertyKeys are
either a Symbol or a String. We now respect that in Proxy.Get and
Proxy.GetOwnProperty.

runtime/Completion.cpp:

(JSC::profiledEvaluate):
(JSC::createSymbolForEntryPointModule):
(JSC::identifierToJSValue): Deleted.

runtime/Identifier.h:

(JSC::parseIndex):

runtime/IdentifierInlines.h:

(JSC::Identifier::fromString):
(JSC::identifierToJSValue):
(JSC::identifierToSafePublicJSValue):

runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):

tests/es6.yaml:
tests/stress/proxy-basic.js:

(let.handler.getOwnPropertyDescriptor):

4:03 PM Changeset in webkit [196784] by mmaxfield@apple.com

4 edits in trunk/Source/WebCore

Addressing post-review comments after r196747.

Unreviewed.

css/CSSFontFaceSet.h:
css/FontFaceSet.cpp:

(WebCore::FontFaceSet::size):
(WebCore::FontFaceSet::clear):

css/FontFaceSet.h:

4:01 PM Changeset in webkit [196783] by andersca@apple.com

3 edits
1 delete in trunk

.:
Get rid of the "All Source (target WebProcess)" scheme.

Rubber-stamped by Dan Bernstein.

WebKit.xcworkspace/xcshareddata/xcschemes/All Source (target WebProcess).xcscheme: Removed.

Tools:
Get rid of the --target-web-process and --use-web-process-xpc-service options.

Rubber-stamped by Dan Bernstein.

We now always use XPC, and --target-web-process is no longer supported.

Scripts/webkitdirs.pm:

(execMacWebKitAppForDebugging):
(shouldTargetWebProcess): Deleted.
(determineShouldTargetWebProcess): Deleted.
(shouldUseXPCServiceForWebProcess): Deleted.
(determineShouldUseXPCServiceForWebProcess): Deleted.
(printHelpAndExitForRunAndDebugWebKitAppIfNeeded): Deleted.
(argumentsForRunAndDebugMacWebKitApp): Deleted.

3:48 PM Changeset in webkit [196782] by Alan Bujtas

3 edits
2 adds in trunk

Soft hyphen is not shown when it is placed at the end of an inline element
https://bugs.webkit.org/show_bug.cgi?id=153980

Reviewed by David Hyatt.

This patch handles the case when the character at the breaking position does not fit the
line and soft-hyphen, as the first breaking opportunity, is followed by this overflowing character.
(foobar where b overflows the line).
In such cases we don't yet have an item in the breaking history so we need to take a look at
the current context instead.

Source/WebCore:

Test: fast/text/soft-hyphen-as-first-breaking-opportunity.html

rendering/line/BreakingContext.h:

(WebCore::BreakingContext::InlineIteratorHistory::nextBreakablePosition):
(WebCore::BreakingContext::handleText):

LayoutTests:

fast/text/soft-hyphen-as-first-breaking-opportunity-expected.html: Added.
fast/text/soft-hyphen-as-first-breaking-opportunity.html: Added.

3:43 PM Changeset in webkit [196781] by Ryan Haddad

2 edits in trunk/Tools

Skip API test WTF_ParkingLot.UnparkOneFiftyThenFiftyAll on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=153997

Reviewed by Filip Pizlo.

TestWebKitAPI/Tests/WTF/ParkingLot.cpp:

3:35 PM Changeset in webkit [196780] by akling@apple.com

4 edits in trunk/Source/WebCore

Fake memory pressure handler should log detailed memory breakdown.
<https://webkit.org/b/154415>

Reviewed by Antti Koivisto.

Piggyback on the RESOURCE_USAGE code to implement some detailed memory footprint diffing
and have the fake memory handler dump before/after/diff after it runs.

page/ResourceUsageThread.h:

(WebCore::TagInfo::TagInfo):

page/cocoa/ResourceUsageThreadCocoa.mm:

(WebCore::logFootprintComparison):
(WebCore::displayNameForVMTag):
(WebCore::pagesPerVMTag):
(WebCore::TagInfo::TagInfo): Deleted.

platform/cocoa/MemoryPressureHandlerCocoa.mm:

(WebCore::MemoryPressureHandler::install):

2:42 PM Changeset in webkit [196779] by beidson@apple.com

9 edits in trunk/Source

Modern IDB: Implement server->client operations in WK2.
https://bugs.webkit.org/show_bug.cgi?id=154411

Reviewed by Alex Christensen.

No change in behavior yet; Just laying the groundwork.
Source/WebCore:

Modules/indexeddb/client/IDBConnectionToServer.h:
Modules/indexeddb/server/IDBServer.h:
Modules/indexeddb/shared/IDBTransactionInfo.h:

(WebCore::IDBTransactionInfo::encode):
(WebCore::IDBTransactionInfo::decode):

Source/WebKit2:

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.cpp:

(WebKit::WebIDBConnectionToClient::WebIDBConnectionToClient):
(WebKit::WebIDBConnectionToClient::~WebIDBConnectionToClient):

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::didDeleteDatabase):
(WebKit::WebIDBConnectionToServer::didOpenDatabase):
(WebKit::WebIDBConnectionToServer::didAbortTransaction):
(WebKit::WebIDBConnectionToServer::didCommitTransaction):
(WebKit::WebIDBConnectionToServer::didCreateObjectStore):
(WebKit::WebIDBConnectionToServer::didDeleteObjectStore):
(WebKit::WebIDBConnectionToServer::didClearObjectStore):
(WebKit::WebIDBConnectionToServer::didCreateIndex):
(WebKit::WebIDBConnectionToServer::didDeleteIndex):
(WebKit::WebIDBConnectionToServer::didPutOrAdd):
(WebKit::WebIDBConnectionToServer::didGetRecord):
(WebKit::WebIDBConnectionToServer::didGetCount):
(WebKit::WebIDBConnectionToServer::didDeleteRecord):
(WebKit::WebIDBConnectionToServer::didOpenCursor):
(WebKit::WebIDBConnectionToServer::didIterateCursor):
(WebKit::WebIDBConnectionToServer::fireVersionChangeEvent):
(WebKit::WebIDBConnectionToServer::didStartTransaction):
(WebKit::WebIDBConnectionToServer::notifyOpenDBRequestBlocked):

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.h:

WebProcess/Databases/WebToDatabaseProcessConnection.cpp:

(WebKit::WebToDatabaseProcessConnection::didReceiveMessage):

2:31 PM Changeset in webkit [196778] by jer.noble@apple.com

5 edits in trunk/Tools

run-webkit-httpd should use webkitpy to run httpd.
https://bugs.webkit.org/show_bug.cgi?id=154271

Reviewed by Alexey Proskuryakov.

Update run-webkit-httpd to use webkitpy.port to launch httpd. Pass on http_port and http_all_interface
options to match the current run-webkit-httpd (optional) behavior.

Scripts/run-webkit-httpd:

(parse_args):
(main):

Scripts/webkitpy/layout_tests/servers/apache_http_server.py:

(LayoutTestApacheHttpd.init):

Scripts/webkitpy/layout_tests/servers/http_server.py:

(Lighttpd._prepare_config):

Scripts/webkitpy/port/base.py:

(Port.to.start_http_server):

1:58 PM Changeset in webkit [196777] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196770

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

1:58 PM Changeset in webkit [196776] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-forms.html for ios-simulator after r196769

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:

1:55 PM Changeset in webkit [196775] by sbarati@apple.com

4 edits in trunk/Source/JavaScriptCore

Follow up fix to Implement Proxy.GetOwnProperty
https://bugs.webkit.org/show_bug.cgi?id=154314

Reviewed by Filip Pizlo.

Part of the implementation was broken because
of how JSObject::getOwnPropertyDescriptor worked.
I've fixed JSObject::getOwnPropertyDescriptor to
be able to handle ProxyObject.

runtime/JSObject.cpp:

(JSC::JSObject::getOwnPropertyDescriptor):

runtime/ProxyObject.cpp:

(JSC::ProxyObject::performInternalMethodGetOwnProperty):

tests/stress/proxy-get-own-property.js:

(assert):
(assert.let.handler.get getOwnPropertyDescriptor):

1:30 PM Changeset in webkit [196774] by BJ Burg

2 edits in trunk/Source/WebKit2

RemoteInspector deadlocks if _WKAutomationDelegate creates/registers a target synchronously
https://bugs.webkit.org/show_bug.cgi?id=154359
<rdar://problem/24708897>

Reviewed by Joseph Pecoraro.

UIProcess/Cocoa/AutomationClient.mm:

(WebKit::AutomationClient::requestAutomationSession):
Make an NSString out of the String reference so it gets captured correctly.

12:59 PM Changeset in webkit [196773] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

Fix unused-const-variable warning on non Cocoa platforms
https://bugs.webkit.org/show_bug.cgi?id=154394

Reviewed by Michael Catanzaro.

html/HTMLPlugInImageElement.cpp:

12:32 PM ASanWebKit edited by ddkilzer@webkit.org

Updated for Mac OS X 10.11 El Capitan and later. (diff)

12:29 PM Changeset in webkit [196772] by sbarati@apple.com

8 edits
1 add in trunk/Source/JavaScriptCore

Implement Proxy.GetOwnProperty
https://bugs.webkit.org/show_bug.cgi?id=154314

Reviewed by Filip Pizlo.

This patch implements Proxy.GetOwnProperty.
It's a straight forward implementation as described
in section 9.5.5 of the specification:
http://www.ecma-international.org/ecma-262/6.0/index.html#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p

runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncBind):

runtime/JSObject.cpp:

(JSC::validateAndApplyPropertyDescriptor):
(JSC::JSObject::defineOwnNonIndexProperty):
(JSC::JSObject::defineOwnProperty):
(JSC::JSObject::getGenericPropertyNames):
(JSC::JSObject::getMethod):

runtime/JSObject.h:

(JSC::JSObject::butterflyAddress):
(JSC::makeIdentifier):

runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::getOwnPropertySlotCommon):
(JSC::ProxyObject::getOwnPropertySlot):
(JSC::ProxyObject::getOwnPropertySlotByIndex):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h:
tests/es6.yaml:
tests/stress/proxy-basic.js:

(let.handler.get null):

tests/stress/proxy-get-own-property.js: Added.

(assert):
(throw.new.Error.let.handler.getOwnPropertyDescriptor):
(throw.new.Error):
(let.handler.getOwnPropertyDescriptor):
(i.catch):
(assert.let.handler.getOwnPropertyDescriptor):

12:23 PM Changeset in webkit [196771] by beidson@apple.com

14 edits in trunk/Source

Modern IDB: Implement client->server operations in WK2.
https://bugs.webkit.org/show_bug.cgi?id=154400

Reviewed by Alex Christensen.

No change in behavior yet; Just laying the groundwork.

Source/WebCore:

Modules/indexeddb/server/IDBServer.h:
Modules/indexeddb/server/UniqueIDBDatabase.h:
Modules/indexeddb/shared/IDBIndexInfo.h:
Modules/indexeddb/shared/IDBObjectStoreInfo.h:

Source/WebKit2:

DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::idbServer):

DatabaseProcess/DatabaseProcess.h:

DatabaseProcess/DatabaseToWebProcessConnection.cpp:

(WebKit::DatabaseToWebProcessConnection::didReceiveMessage):

DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.h:

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.cpp:

(WebKit::WebIDBConnectionToClient::deleteDatabase):
(WebKit::WebIDBConnectionToClient::openDatabase):
(WebKit::WebIDBConnectionToClient::abortTransaction):
(WebKit::WebIDBConnectionToClient::commitTransaction):
(WebKit::WebIDBConnectionToClient::didFinishHandlingVersionChangeTransaction):
(WebKit::WebIDBConnectionToClient::createObjectStore):
(WebKit::WebIDBConnectionToClient::deleteObjectStore):
(WebKit::WebIDBConnectionToClient::clearObjectStore):
(WebKit::WebIDBConnectionToClient::createIndex):
(WebKit::WebIDBConnectionToClient::deleteIndex):
(WebKit::WebIDBConnectionToClient::putOrAdd):
(WebKit::WebIDBConnectionToClient::getRecord):
(WebKit::WebIDBConnectionToClient::getCount):
(WebKit::WebIDBConnectionToClient::deleteRecord):
(WebKit::WebIDBConnectionToClient::openCursor):
(WebKit::WebIDBConnectionToClient::iterateCursor):
(WebKit::WebIDBConnectionToClient::establishTransaction):
(WebKit::WebIDBConnectionToClient::databaseConnectionClosed):
(WebKit::WebIDBConnectionToClient::abortOpenAndUpgradeNeeded):
(WebKit::WebIDBConnectionToClient::didFireVersionChangeEvent):

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h:
DatabaseProcess/IndexedDB/WebIDBConnectionToClient.messages.in:

12:18 PM Changeset in webkit [196770] by Chris Dumez

10 edits in trunk

[Unforgeable] operations should not be writable as per Web IDL
https://bugs.webkit.org/show_bug.cgi?id=154396
<rdar://problem/24721063>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

[Unforgeable] operations should not be writable as per the Web IDL specification:
http://heycam.github.io/webidl/#es-operations

They were currently non-configurable in WebKit but still writable.

No new tests, already covered by existing test.

bindings/scripts/CodeGeneratorJS.pm:

Mark [Unforgeable] operations as ReadOnly.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:
bindings/scripts/test/TestObj.idl:

Add bindings test coverage for [Unforgeable].

12:14 PM Changeset in webkit [196769] by Chris Dumez

12 edits in trunk

Fix behavior of reflecting unsigned long IDL attributes that are limited to only non-negative numbers greater than zero
https://bugs.webkit.org/show_bug.cgi?id=154398

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/reflection-forms-expected.txt:
web-platform-tests/html/dom/reflection-tabular-expected.txt:

Source/WebCore:

Fix behavior of reflecting unsigned long IDL attributes that are limited
to only non-negative numbers greater than zero to comply with:

https://html.spec.whatwg.org/#limited-to-only-non-negative-numbers-greater-than-zero

This patch updates the following IDL attributes:

colgroup.span
col.span
input.size
textarea.cols
textareal.rows

All of them now:

Have "unsigned long" type on IDL size and "unsigned" type on native side.
On getting, return the value if it is in the range [1; 2147483647], otherwise return the default value.
On setting, set to the input value if it is in the range [1; 2147483647], otherwise, set to the default value.

Note that as per the specification, we are supposed to throw an
IndexSizeError exception when trying to set those attributes to zero.
However, we instead use the default value to match other browsers.
It would be risky to be the only browser to throw in this case.

No new tests, already covered by existing test.

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::parseAttribute):
(WebCore::HTMLInputElement::setSize):

html/HTMLTableColElement.cpp:

(WebCore::HTMLTableColElement::parseAttribute):
(WebCore::HTMLTableColElement::setSpan):

html/HTMLTableColElement.h:
html/HTMLTableColElement.idl:
html/HTMLTextAreaElement.cpp:

(WebCore::HTMLTextAreaElement::parseAttribute):
(WebCore::HTMLTextAreaElement::setCols):
(WebCore::HTMLTextAreaElement::setRows):
(WebCore::HTMLTextAreaElement::shouldUseInputMethod): Deleted.

html/HTMLTextAreaElement.h:
html/HTMLTextAreaElement.idl:
html/parser/HTMLParserIdioms.h:

(WebCore::limitToOnlyNonNegativeNumbersGreaterThanZero):

12:07 PM Changeset in webkit [196768] by rniwa@webkit.org

6 edits
1 add in trunk/Websites/perf.webkit.org

v3 UI should allow custom revisions for A/B testing
https://bugs.webkit.org/show_bug.cgi?id=154379

Reviewed by Chris Dumez.

Added the capability to customize revisions selected in the overview chart and the results viewer.

Newly added CustomizableTestGroupForm is responsible for allowing users to modify the set of revisions in
a new A/B testing group. Unlike TestGroupForm which doesn't know anything about which revisions are selected
for each project/repository, CustomizableTestGroupForm is aware of the list of revisions used in each set.

The list of revisions used in each set is represented by RootSet if users had not customized them, and
CustomRootSet otherwise; the latter was added since regular RootSet object requires CommitLog and other
DataModelObjects which are hard to create without corresponding database entries.

public/v3/components/customizable-test-group-form.js: Added.

(CustomizableTestGroupForm): Added.
(CustomizableTestGroupForm.prototype.setRootSetMap): Added.
(CustomizableTestGroupForm.prototype._submitted): Overrides the superclass' method.
(CustomizableTestGroupForm.prototype._customize): Ditto. Unlike TestGroupForm's callback, this class'
callback passes in a root set map as the third argument.
(CustomizableTestGroupForm.prototype._computeRootSetMap): Added. Returns this._rootSetMap, which is set by
AnalysisTaskPage if user had not customized the root sets. Otherwise return a new map with CustomRootSet's.
(CustomizableTestGroupForm.prototype.render): Added. Creates a table to allow customization of root sets.
(CustomizableTestGroupForm._constructRevisionRadioButtons): Added.
(CustomizableTestGroupForm._createRadioButton): Added.
(CustomizableTestGroupForm.cssTemplate): Added.
(CustomizableTestGroupForm.formContent): Added. This method is called by TestGroupForm.htmlTemplate.

public/v3/components/test-group-form.js:

(TestGroupForm): Updated the various methods to not directly mutate DOM. Store the state in instance
variables and update DOM in render() as done elsewhere.
(TestGroupForm.prototype.setNeedsName): Deleted. We no longer need this flag since TestGroupForm which is
used for retries never needs a name and CustomizableTestGroupForm which is used to create a new test group
always requires a name.
(TestGroupForm.prototype.setDisabled):
(TestGroupForm.prototype.setLabel):
(TestGroupForm.prototype.setRepetitionCount):
(TestGroupForm.prototype.render): Added.
(TestGroupForm.prototype._submitted): Moved the code to prevent the default action has been moved to the
constructor since this method is overridden by CustomizableTestGroupForm.
(TestGroupForm.cssTemplate): Added.
(TestGroupForm.htmlTemplate):
(TestGroupForm.formContent): Extracted from htmlTemplate.

public/v3/index.html:
public/v3/models/repository.js:

(Repository.sortByNamePreferringOnesWithURL): Added.

public/v3/models/root-set.js:

(RootSet.prototype.revisionForRepository): Added so that _createTestGroupAfterVerifyingRootSetList can retrieve
the revision information from CustomRootSet without going through CommitLog objects since CustomRootSet doesn't
have associated CommitLog objects.
(CustomRootSet): Added. Used by CustomizableTestGroupForm to create a custom root map since regular RootSet
requires CommitLog and other related objects which are hard to create without database entries.
(CustomRootSet.prototype.setRevisionForRepository): Added.
(CustomRootSet.prototype.repositories): Added.
(CustomRootSet.prototype.revisionForRepository): Added.

public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage):
(AnalysisTaskPage.prototype.render): Removed the reference to v2 UI since v3 UI is now strictly more powerful
than v2 UI. Also update the root set maps in each form here.
(AnalysisTaskPage.prototype._retryCurrentTestGroup): No longer takes unused name argument as it got removed
from TestGroupForm.
(AnalysisTaskPage.prototype._chartSelectionDidChange): No longer updates the disabled-ness here since it's now
done in render() via setRootSetMap().
(AnalysisTaskPage.prototype._createNewTestGroupFromChart): Now takes rootSetMap as an argument.
(AnalysisTaskPage.prototype._selectedRowInAnalysisResultsViewer): No longer updates the disabled-ness here
since it's now done in render() via setRootSetMap().
(AnalysisTaskPage.prototype._createNewTestGroupFromViewer): Now takes rootSetMap as an argument.
(AnalysisTaskPage.prototype._createTestGroupAfterVerifyingRootSetList): Take a dictionary of root set labels
such as A and B, which maps to a RootSet or a newly-added CustomRootSet.
(AnalysisTaskPage.htmlTemplate): Use customizable-test-group-form for creating a new A/B testing group. Retry
form will continue to use TestGroupForm since customizing revisions is non-sensical in retries.
(AnalysisTaskPage.cssTemplate): Updated the style.

11:06 AM Changeset in webkit [196767] by ChangSeok Oh

3 edits in trunk/Source/WebKit2

[GTK][Threaded Compositor] The web inspector doesn't work when using the threaded compositor
https://bugs.webkit.org/show_bug.cgi?id=154067

Reviewed by Carlos Garcia Campos.

The forceCompositingMode should be true for threaded compositor. We set it true for a normal webView
in _WebKitSettingsPrivate() but we do not for inspector anywhere. So DrawingArea is not
properly created for the inspector. Let's move the setting to WebPreferences::platformInitializeStore
which is a common place for the webView and the inspector.

UIProcess/API/gtk/WebKitSettings.cpp:

(_WebKitSettingsPrivate::_WebKitSettingsPrivate): Deleted.

UIProcess/gtk/WebPreferencesGtk.cpp:

(WebKit::WebPreferences::platformInitializeStore):

11:02 AM Changeset in webkit [196766] by commit-queue@webkit.org

3 edits in trunk/Source/WebKit2

Unreviewed, rolling out r196765.
https://bugs.webkit.org/show_bug.cgi?id=154402

Broke Safari (Requested by andersca on #webkit).

Reverted changeset:

"Remove two unused functions"
https://bugs.webkit.org/show_bug.cgi?id=154397
http://trac.webkit.org/changeset/196765

10:44 AM Changeset in webkit [196765] by andersca@apple.com

3 edits in trunk/Source/WebKit2

Remove two unused functions
https://bugs.webkit.org/show_bug.cgi?id=154397

Reviewed by Tim Horton.

UIProcess/API/C/WKContext.cpp:

(WKContextGetPluginSiteDataManager): Deleted.
(WKContextGetResourceCacheManager): Deleted.

UIProcess/API/C/WKContext.h:

10:21 AM Changeset in webkit [196764] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196742

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

10:13 AM Changeset in webkit [196763] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore

Remove redundant ASSERT_WITH_MESSAGE_UNUSED() from SOFT_LINK_FRAMEWORK_FOR_SOURCE() macro

Follow-up fix noted by Andy Estes for:

[Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
<http://webkit.org/b/154364>

platform/mac/SoftLinking.h:

(SOFT_LINK_FRAMEWORK_FOR_SOURCE): Remove redundant
ASSERT_WITH_MESSAGE_UNUSED().

9:53 AM Changeset in webkit [196762] by Csaba Osztrogonác

14 edits in trunk/LayoutTests

JSC ARM Linux test gardening after r196625
https://bugs.webkit.org/show_bug.cgi?id=154392

Reviewed by Mark Lam.

js/script-tests/dfg-float32array.js:
js/script-tests/dfg-float64array.js:
js/script-tests/dfg-int16array.js:
js/script-tests/dfg-int32array-overflow-values.js:
js/script-tests/dfg-int32array.js:
js/script-tests/dfg-int8array.js:
js/script-tests/dfg-osr-entry-hoisted-clobbered-structure-check.js:
js/script-tests/dfg-uint16array.js:
js/script-tests/dfg-uint32array-overflow-values.js:
js/script-tests/dfg-uint32array.js:
js/script-tests/dfg-uint8array.js:
js/script-tests/dfg-uint8clampedarray.js:
js/script-tests/regress-141098.js:

9:25 AM Changeset in webkit [196761] by akling@apple.com

2 edits in trunk/Source/JavaScriptCore

JSString resolution of substrings should use StringImpl sharing optimization.
<https://webkit.org/b/154068>
<rdar://problem/24629358>

Reviewed by Antti Koivisto.

When resolving a JSString that's actually a substring of another JSString,
use the StringImpl sharing optimization to create a new string pointing into
the parent one, instead of copying out the bytes of the string.

This dramatically reduces peak memory usage on Gerrit diff viewer pages.

Another approach to this would be to induce GC far more frequently due to
the added cost of copying out these substrings. It would reduce the risk
of prolonging the life of strings only kept alive by substrings.

This patch chooses to trade that risk for less GC and lower peak memory.

runtime/JSString.cpp:

(JSC::JSRopeString::resolveRope):

9:19 AM Changeset in webkit [196760] by Chris Dumez

2 edits in trunk/Source/JavaScriptCore

Crash on SES selftest page when loading the page while WebInspector is open
https://bugs.webkit.org/show_bug.cgi?id=154378
<rdar://problem/24713422>

Reviewed by Mark Lam.

Do a partial revert of r196676 so that JSObject::getOwnPropertyDescriptor()
returns early again if it detects that getOwnPropertySlot() returns a
non-own property. This check was removed in r196676 because we assumed that
only JSDOMWindow::getOwnPropertySlot() could return non-own properties.
However, as it turns out, DebuggerScope::getOwnPropertySlot() does so as
well.

Not having the check would lead to crashes when using the debugger because
we would get a slot with the CustomAccessor attribute but getDirect() would
then fail to return the property (because it is not an own property). We
would then cast the value returned by getDirect() to a CustomGetterSetter*
and dereference it.

runtime/JSObject.cpp:

(JSC::JSObject::getOwnPropertyDescriptor):

8:55 AM Changeset in webkit [196759] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

Unreviewed, fix VS build. I didn't know we still did that, but apparently there's a bot
for that.

JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:

8:48 AM Changeset in webkit [196758] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix CMake build. This got messed up when rebasing.

CMakeLists.txt:

8:45 AM Changeset in webkit [196757] by Csaba Osztrogonác

2 edits in trunk/Source/JavaScriptCore

Fix the !ENABLE(DFG_JIT) build after r195865
https://bugs.webkit.org/show_bug.cgi?id=154391

Reviewed by Filip Pizlo.

runtime/SamplingProfiler.cpp:

(JSC::tryGetBytecodeIndex):

8:40 AM Changeset in webkit [196756] by fpizlo@apple.com

27 edits
3 moves
1 delete in trunk

Remove remaining references to LLVM, and make sure comments refer to the backend as "B3" not "LLVM"
https://bugs.webkit.org/show_bug.cgi?id=154383

Reviewed by Saam Barati.

Source/JavaScriptCore:

I did a grep -i llvm of all of our code and did one of the following for each occurence:

Renamed it to B3. This is appropriate when we were using "LLVM" to mean "the FTL backend".

Removed the reference because I found it to be dead. In some cases it was a dead comment: it was telling us things about what LLVM did and that's just not relevant anymore. In other cases it was dead code that I forgot to delete in a previous patch.

Edited the comment in some smart way. There were comments talking about what LLVM did that were still of interest. In some cases, I added a FIXME to consider changing the code below the comment on the grounds that it was written in a weird way to placate LLVM and so we can do it better now.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
dfg/DFGArgumentsEliminationPhase.cpp:
dfg/DFGOSRAvailabilityAnalysisPhase.h:
dfg/DFGPlan.cpp:

(JSC::DFG::Plan::compileInThread):
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::compileTimeStats):

dfg/DFGPutStackSinkingPhase.cpp:
dfg/DFGSSAConversionPhase.h:
dfg/DFGStaticExecutionCountEstimationPhase.h:
dfg/DFGUnificationPhase.cpp:

(JSC::DFG::UnificationPhase::run):

disassembler/ARM64Disassembler.cpp:

(JSC::tryToDisassemble): Deleted.

disassembler/X86Disassembler.cpp:

(JSC::tryToDisassemble):

ftl/FTLAbstractHeap.cpp:

(JSC::FTL::IndexedAbstractHeap::initialize):

ftl/FTLAbstractHeap.h:
ftl/FTLFormattedValue.h:
ftl/FTLJITFinalizer.cpp:

(JSC::FTL::JITFinalizer::finalizeFunction):

ftl/FTLLink.cpp:

(JSC::FTL::link):

ftl/FTLLocation.cpp:

(JSC::FTL::Location::restoreInto):

ftl/FTLLowerDFGToB3.cpp: Copied from Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp.

(JSC::FTL::DFG::ftlUnreachable):
(JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
(JSC::FTL::DFG::LowerDFGToB3::compileBlock):
(JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
(JSC::FTL::DFG::LowerDFGToB3::isBoolean):
(JSC::FTL::DFG::LowerDFGToB3::unboxBoolean):
(JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
(JSC::FTL::lowerDFGToB3):
(JSC::FTL::DFG::LowerDFGToLLVM::LowerDFGToLLVM): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::compileBlock): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithNegate): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::compileMultiGetByOffset): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::compileOverridesHasInstance): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::isBoolean): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::unboxBoolean): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier): Deleted.
(JSC::FTL::lowerDFGToLLVM): Deleted.

ftl/FTLLowerDFGToB3.h: Copied from Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.h.
ftl/FTLLowerDFGToLLVM.cpp: Removed.
ftl/FTLLowerDFGToLLVM.h: Removed.
ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

ftl/FTLWeight.h:

(JSC::FTL::Weight::frequencyClass):
(JSC::FTL::Weight::inverse):
(JSC::FTL::Weight::scaleToTotal): Deleted.

ftl/FTLWeightedTarget.h:

(JSC::FTL::rarely):
(JSC::FTL::unsure):

jit/CallFrameShuffler64.cpp:

(JSC::CallFrameShuffler::emitDisplace):

jit/RegisterSet.cpp:

(JSC::RegisterSet::ftlCalleeSaveRegisters):

llvm: Removed.
llvm/InitializeLLVMLinux.cpp: Removed.
llvm/InitializeLLVMWin.cpp: Removed.
llvm/library: Removed.
llvm/library/LLVMTrapCallback.h: Removed.
llvm/library/libllvmForJSC.version: Removed.
runtime/Options.cpp:

(JSC::recomputeDependentOptions):
(JSC::Options::initialize):

runtime/Options.h:
wasm/WASMFunctionB3IRGenerator.h: Copied from Source/JavaScriptCore/wasm/WASMFunctionLLVMIRGenerator.h.
wasm/WASMFunctionLLVMIRGenerator.h: Removed.
wasm/WASMFunctionParser.cpp:

Tools:

Scripts/run-jsc-stress-tests:

8:12 AM Changeset in webkit [196755] by Carlos Garcia Campos

6 edits in trunk/Source/WebKit2

[GTK] Use G_TYPE_ERROR instead of G_TYPE_POINTER for GError parameters of signals
https://bugs.webkit.org/show_bug.cgi?id=153786

Reviewed by Michael Catanzaro.

It's binary compatible and it's needed by binding generator to
properly identify those parameters as GError.

UIProcess/API/gtk/WebKitDownload.cpp:

(webkit_download_class_init):

UIProcess/API/gtk/WebKitPrintOperation.cpp:

(webkit_print_operation_class_init):

UIProcess/API/gtk/WebKitWebResource.cpp:

(webkit_web_resource_class_init):

UIProcess/API/gtk/WebKitWebView.cpp:

(webkit_web_view_class_init):

UIProcess/API/gtk/webkit2marshal.list:

3:31 AM Changeset in webkit [196754] by ryuan.choi@navercorp.com

2 edits
4 moves in trunk/Source/WebKit2

[EFL] Move WebView from CoordinatedGraphics to efl
https://bugs.webkit.org/show_bug.cgi?id=154332

Reviewed by Csaba Osztrogonác.

PlatformEfl.cmake:
UIProcess/efl/WebView.cpp: Renamed from Source/WebKit2/UIProcess/CoordinatedGraphics/WebView.cpp.
UIProcess/efl/WebView.h: Renamed from Source/WebKit2/UIProcess/CoordinatedGraphics/WebView.h.
UIProcess/efl/WebViewClient.cpp: Renamed from Source/WebKit2/UIProcess/CoordinatedGraphics/WebViewClient.cpp.
UIProcess/efl/WebViewClient.h: Renamed from Source/WebKit2/UIProcess/CoordinatedGraphics/WebViewClient.h.

3:13 AM Changeset in webkit [196753] by akling@apple.com

5 edits in trunk/Source/WebCore

Reduce tiling coverage immediately when memory pressure hits.
<https://webkit.org/b/154374>

Reviewed by Simon Fraser.

We already had a policy that reduced tiling coverage to a minimum while the system
is under memory pressure. However, that policy wouldn't kick in immediately after
receiving the pressure notification, but the next time we flush compositing state.

This change makes it happen sooner, improving our chances to escape death!

page/Page.h:
page/Page.cpp:

(WebCore::Page::forEachPage):

Add a little helper for visiting every Page.

platform/MemoryPressureHandler.cpp:

(WebCore::MemoryPressureHandler::releaseCriticalMemory):

When under critical memory pressure, schedule a compositing flush in all Pages.
This ensures that the reduced tiling coverage policy takes effect, allowing us to
immediately drop several tiles in each visible web view.

platform/cocoa/MemoryPressureHandlerCocoa.mm:

(WebCore::MemoryPressureHandler::install):

To ensure that this behavior is testable with the fake memory pressure notification,
make the fake handler set the "in memory pressure" state just like the real one would.
I don't know why we were not doing this previously, it was just an oversight.
After the simulation completes, it schedules a runloop callback that resets the
"in memory pressure" state.

2:34 AM Changeset in webkit [196752] by Csaba Osztrogonác

2 edits in trunk/Source/JavaScriptCore

[cmake] Build system cleanup
https://bugs.webkit.org/show_bug.cgi?id=154337

Reviewed by Žan Doberšek.

CMakeLists.txt:

12:46 AM Changeset in webkit [196751] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Align console prompt with execution context selector
https://bugs.webkit.org/show_bug.cgi?id=154381

Reviewed by Timothy Hatcher.

UserInterface/Views/QuickConsole.css:

(.quick-console > .console-prompt > .CodeMirror):
(.quick-console .execution-context):

12:34 AM Changeset in webkit [196750] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Storage tab navigation bar should fit on a single line
https://bugs.webkit.org/show_bug.cgi?id=152473
<rdar://problem/24023435>

Patch by Devin Rousso <Devin Rousso> on 2016-02-18
Reviewed by Timothy Hatcher.

UserInterface/Base/Utilities.js:

(Number.constrain):
Reworked logic to ensure that the returned value is never less than the
given minimum value.

12:29 AM Changeset in webkit [196749] by Michael Catanzaro

2 edits
1 delete in trunk

[CMake] Remove LLVM support
https://bugs.webkit.org/show_bug.cgi?id=154370

Reviewed by Csaba Osztrogonác.

After switching all CMake ports to B3, this was only needed for the LLVM disassembler, which
has been removed from JSC. Feel free to bring this back if restoring the LLVM disassembler,
but for the time being this is dead code.

Source/cmake/FindLLVM.cmake: Removed.
Source/cmake/OptionsCommon.cmake:

12:28 AM Changeset in webkit [196748] by jh718.park@samsung.com

2 edits in trunk

[CMake] Remove meaningless conditional statements in CMakeLists.txt
https://bugs.webkit.org/show_bug.cgi?id=153778

Reviewed by Csaba Osztrogonác.

CMakeLists.txt:

Use CMAKE_FOO_OUTPUT_DIRECTORY located in CMakeLists.txt as default value.
And remove conditional statements which has enclosed these one
because they don't have meaning anymore.

Feb 17, 2016:

11:25 PM Changeset in webkit [196747] by mmaxfield@apple.com

25 edits
8 adds in trunk

[Font Loading] Implement FontFaceSet
https://bugs.webkit.org/show_bug.cgi?id=153348

Reviewed by Simon Fraser.

Source/WebCore:

The CSS Font Loading spec includes a FontFaceSet object which represents
a collection of FontFaces. This patch implements such an object, and
backs it with a vector of FontFaces. Similarly to the FontFace object,
FontFaceSet is separated into a FontFaceSet frontend object and a
CSSFontFaceSet backend object, which actually owns the FontFace objects.
All the interaction with Promises is performed in the frontend object.

This patch does not implement the EventTarget part of the FontFaceSet
API, so the only way to know when a font is finished loading is by using
the associated Promise objects.

The CSS Font Loading spec describes how the Document should vend an
instance of FontFaceSet which represents the font faces currently
associated with the Document. However, that functionality is
forthcoming. Currently, the only way to get a FontFaceSet is to create
one yourself (using the constructor). Therefore, this patch does not
implement the spec's notion of a "CSS-connected font face."

Test: fast/text/font-face-set-javascript.html

CMakeLists.txt: Add new files.
DerivedSources.make: Ditto.
WebCore.vcxproj/WebCore.vcxproj: Ditto.
WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
WebCore.xcodeproj/project.pbxproj: Ditto.
bindings/js/JSFontFaceSetCustom.cpp: Added.

(WebCore::JSFontFaceSet::ready): Use the Promise member.
(WebCore::JSFontFaceSet::entries): Use existing iterator code.
(WebCore::JSFontFaceSet::keys):
(WebCore::JSFontFaceSet::values):

css/CSSAllInOne.cpp: Add new files.
css/CSSFontFace.cpp: We now have a collection of clients (instead of

just one). Also, we need to keep a pointer to our FontFace wrapper.
(WebCore::CSSFontFace::CSSFontFace):
(WebCore::CSSFontFace::addClient):
(WebCore::CSSFontFace::removeClient):
(WebCore::CSSFontFace::setStatus): Rename the delegate callback to be
more clear.
(WebCore::CSSFontFace::fontLoaded):
(WebCore::CSSFontFace::addedToSegmentedFontFace): Deleted.
(WebCore::CSSFontFace::removedFromSegmentedFontFace): Deleted.

css/CSSFontFace.h: Same as above.

(WebCore::CSSFontFace::create):
(WebCore::CSSFontFace::Client::~Client):
(WebCore::CSSFontFace::Client::kick):
(WebCore::CSSFontFace::Client::stateChanged):
(WebCore::CSSFontFace::wrapper):
(WebCore::CSSFontFaceClient::~CSSFontFaceClient): Deleted.

css/CSSFontFaceSet.cpp: Added. Initial imlementation.

(WebCore::CSSFontFaceSet::CSSFontFaceSet):
(WebCore::CSSFontFaceSet::~CSSFontFaceSet):
(WebCore::CSSFontFaceSet::incrementActiveCount):
(WebCore::CSSFontFaceSet::decrementActiveCount):
(WebCore::CSSFontFaceSet::has):
(WebCore::CSSFontFaceSet::add):
(WebCore::CSSFontFaceSet::remove):
(WebCore::extractFamilies):
(WebCore::familiesIntersect): Because this is an initial imlementation,
this function is not optimized. A subsequent patch (which implements
Document.fonts) will optimize this.
(WebCore::CSSFontFaceSet::matchingFaces):
(WebCore::CSSFontFaceSet::load):
(WebCore::CSSFontFaceSet::check):
(WebCore::CSSFontFaceSet::stateChanged):

css/CSSFontFaceSet.h: Added.

(WebCore::CSSFontFaceSetClient::~CSSFontFaceSetClient):
(WebCore::CSSFontFaceSet::size):
(WebCore::CSSFontFaceSet::operator[]):
(WebCore::CSSFontFaceSet::status):

css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::familyNameFromPrimitive):
(WebCore::CSSFontSelector::registerLocalFontFacesForFamily):
(WebCore::CSSFontSelector::addFontFaceRule):
(WebCore::familyNameFromPrimitive): Deleted.
(WebCore::CSSFontSelector::kick): Deleted.

css/CSSFontSelector.h:
css/CSSSegmentedFontFace.cpp:

(WebCore::CSSSegmentedFontFace::~CSSSegmentedFontFace):
(WebCore::CSSSegmentedFontFace::appendFontFace):
(WebCore::CSSSegmentedFontFace::kick):
(WebCore::CSSSegmentedFontFace::fontLoaded): Deleted.

css/CSSSegmentedFontFace.h:
css/FontFace.cpp:

(WebCore::FontFace::FontFace):
(WebCore::FontFace::~FontFace):
(WebCore::FontFace::stateChanged): Renamed to make its purpose clearer.
(WebCore::FontFace::kick): Deleted.

css/FontFace.h:
css/FontFaceSet.cpp: Added.

(WebCore::createPromise):
(WebCore::FontFaceSet::FontFaceSet):
(WebCore::FontFaceSet::~FontFaceSet):
(WebCore::FontFaceSet::Iterator::Iterator):
(WebCore::FontFaceSet::Iterator::next):
(WebCore::FontFaceSet::PendingPromise::PendingPromise):
(WebCore::FontFaceSet::PendingPromise::~PendingPromise):
(WebCore::FontFaceSet::has):
(WebCore::FontFaceSet::size):
(WebCore::FontFaceSet::add):
(WebCore::FontFaceSet::remove):
(WebCore::FontFaceSet::clear):
(WebCore::FontFaceSet::load): Most of the complexity of loading is
due to the promises involved. Rather than use the Javascript function
Promise.all(), this patch builds a data structure to represent the
promises which need to be resolved. When fonts finish loading, we look
at the data structure to determine which promises to resolve.
(WebCore::FontFaceSet::check):
(WebCore::FontFaceSet::status):
(WebCore::FontFaceSet::canSuspendForDocumentSuspension):
(WebCore::FontFaceSet::startedLoading):
(WebCore::FontFaceSet::completedLoading):
(WebCore::FontFaceSet::fulfillPromise): Keep the promise alive.
(WebCore::FontFaceSet::faceFinished):

css/FontFaceSet.h: Added.

(WebCore::FontFaceSet::create):
(WebCore::FontFaceSet::load):
(WebCore::FontFaceSet::check):
(WebCore::FontFaceSet::createIterator):
(WebCore::FontFaceSet::PendingPromise::create):

css/FontFaceSet.idl: Added.
dom/EventNames.h:
dom/EventTargetFactory.in:

LayoutTests:

fast/text/font-face-set-javascript-expected.txt: Added.
fast/text/font-face-set-javascript.html: Added.

10:37 PM Changeset in webkit [196746] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: In the styles sidebar, Option-clicking on --css-variable should jump to its definition
https://bugs.webkit.org/show_bug.cgi?id=154082
<rdar://problem/24593361>

Patch by Devin Rousso <Devin Rousso> on 2016-02-17
Reviewed by Timothy Hatcher.

UserInterface/Views/CSSStyleDeclarationTextEditor.js:

(WebInspector.CSSStyleDeclarationTextEditor.prototype.tokenTrackingControllerHighlightedRangeWasClicked.showRangeInSourceCode):
(WebInspector.CSSStyleDeclarationTextEditor.prototype.tokenTrackingControllerHighlightedRangeWasClicked):
Now tests to see if the highlighted token was a CSS variable and if
so, attempts to show the declaration of the CSS variable instead of
the location where it is used.

10:28 PM Changeset in webkit [196745] by mark.lam@apple.com

8 edits in trunk/Source

Callers of JSString::value() should check for exceptions thereafter.
https://bugs.webkit.org/show_bug.cgi?id=154346

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

JSString::value() can throw an exception if the JS string is a rope and value()
needs to resolve the rope but encounters an OutOfMemory error. If value() is not
able to resolve the rope, it will return a null string (in addition to throwing
the exception). If a caller does not check for exceptions after calling
JSString::value(), they may eventually use the returned null string and crash the
VM.

The fix is to add all the necessary exception checks, and do the appropriate
handling if needed.

jsc.cpp:

(functionRun):
(functionLoad):
(functionReadFile):
(functionCheckSyntax):
(functionLoadWebAssembly):
(functionLoadModule):
(functionCheckModuleSyntax):

runtime/DateConstructor.cpp:

(JSC::dateParse):
(JSC::dateNow):

runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncEval):

tools/JSDollarVMPrototype.cpp:

(JSC::functionPrint):

Source/WebCore:

No new tests. The crash that results from this issue is dependent on a race
condition where an OutOfMemory error occurs precisely at the point where the
JSString::value() function is called on a rope JSString.

bindings/js/JSHTMLAllCollectionCustom.cpp:

(WebCore::callHTMLAllCollection):

bindings/js/JSStorageCustom.cpp:

(WebCore::JSStorage::putDelegate):

Added a comment at the site of the exception check to clarify the meaning of the return value.

10:13 PM Changeset in webkit [196744] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore

[Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
<http://webkit.org/b/154364>

Reviewed by Alexey Proskuryakov.

platform/mac/SoftLinking.h:

(SOFT_LINK_LIBRARY): Change ASSERT_WITH_MESSAGE() to
RELEASE_ASSERT_WITH_MESSAGE().
(SOFT_LINK_FRAMEWORK): Ditto.
(SOFT_LINK_PRIVATE_FRAMEWORK): Ditto.
(SOFT_LINK_STAGED_FRAMEWORK): Ditto.
(SOFT_LINK_FRAMEWORK_IN_UMBRELLA): Ditto.
(SOFT_LINK): Ditto.
(SOFT_LINK_POINTER): Ditto.
(SOFT_LINK_CONSTANT): Ditto.
(SOFT_LINK_FRAMEWORK_FOR_SOURCE): Add
RELEASE_ASSERT_WITH_MESSAGE() when soft-link is not
optional.

10:03 PM Changeset in webkit [196743] by Nikita Vasilyev

3 edits in trunk/Source/WebInspectorUI

REGRESSION (r196620): Web Inspector: DataGrid headers and resizers are misaligned when the scrollbar is visible
https://bugs.webkit.org/show_bug.cgi?id=154280
<rdar://problem/24670567>

Reviewed by Timothy Hatcher.

Revert back to "overflow-y: overlay".

UserInterface/Views/DataGrid.css:

(.data-grid .data-container):

UserInterface/Views/DatabaseContentView.css:

(.storage-view.query):

9:44 PM Changeset in webkit [196742] by Chris Dumez

4 edits in trunk

Regression(r196648): http://w3c-test.org/html/dom/interfaces.html redirects at the end of the test
https://bugs.webkit.org/show_bug.cgi?id=154357

Reviewed by Alexey Proskuryakov.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Make location.assign() / location.replace()'s parameter mandatory,
as per the specification:
https://html.spec.whatwg.org/multipage/browsers.html#the-location-interface

Previously, calling location.assign() / location.replace() without
parameter would be identical to calling location.assign("undefined") /
location.replace("undefined"), which is not useful.

After r196648, http://w3c-test.org/html/dom/interfaces.html was able to
test location.assign() / location.replace() further because they are now
on the instance (where they should be) instead of the prototype. One of
these tests calls these functions without parameter, expecting them to
throw an exception. However, in WebKit, it would not throw and it would
redirect us to http://w3c-test.org/html/dom/undefined.

Firefox and Chrome both follow the specification already and throw in
this case.

No new tests, already covered by existing test.

page/Location.idl:

Make location.assign() / location.replace()'s parameter mandatory,
as per the specification.

9:27 PM Changeset in webkit [196741] by Nikita Vasilyev

4 edits in trunk/Source/WebInspectorUI

REGRESSION (r196620): Web Inspector: When the scrollbars are always visible, the console prompt is 1px taller
https://bugs.webkit.org/show_bug.cgi?id=154328
<rdar://problem/24692996>

Introduce a CSS variable to ensure that the quick console is the
same height as the bottom right section of the styles sidebar.

Reviewed by Timothy Hatcher.

UserInterface/Views/CSSStyleDetailsSidebarPanel.css:

(.sidebar > .panel.details.css-style > .content ~ .options-container):
(.sidebar > .panel.details.css-style > .content ~ .class-list-container):

UserInterface/Views/QuickConsole.css:

(.quick-console):

UserInterface/Views/Variables.css:

(:root):

9:16 PM Changeset in webkit [196740] by commit-queue@webkit.org

10 edits in trunk

Unreviewed, rolling out r196738.
https://bugs.webkit.org/show_bug.cgi?id=154380

broke css3/calc/transforms-translate.html (Requested by
alexchristensen on #webkit).

Reverted changeset:

"WebKitCSSMatrix transformList with calculated relative length
crashes Safari."
https://bugs.webkit.org/show_bug.cgi?id=153333
http://trac.webkit.org/changeset/196738

7:57 PM Changeset in webkit [196739] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Add Context menu separators to Styles sidebar
https://bugs.webkit.org/show_bug.cgi?id=154360

Patch by Devin Rousso <Devin Rousso> on 2016-02-17
Reviewed by Joseph Pecoraro.

In the Styles sidebar, there are three main sections for the context menu:

Copy and Duplicate/Show-source
Add pseudo-class rules
Add/Select pseudo-element rules

These three sections were all put together in the same context menu, which
was very crowded as a result. Separators have been added to make it so that
these three sections are now separated and clearly show their different uses.

UserInterface/Views/CSSStyleDeclarationSection.js:

(WebInspector.CSSStyleDeclarationSection.prototype._handleSelectorPaste):

UserInterface/Views/VisualStyleSelectorTreeItem.js:

(WebInspector.VisualStyleSelectorTreeItem.prototype._handleContextMenuEvent):

6:13 PM Changeset in webkit [196738] by dino@apple.com

10 edits in trunk

WebKitCSSMatrix transformList with calculated relative length crashes Safari.
https://bugs.webkit.org/show_bug.cgi?id=153333
<rdar://problem/17198383>

Reviewed by Simon Fraser.

Source/WebCore:

WebKitCSSMatrix objects should fail to construct when not
using absolute lengths.

Updated existing tests:

transforms/cssmatrix-2d-interface.xhtml
transforms/cssmatrix-3d-interface.xhtml

css/StyleBuilderConverter.h:

(WebCore::StyleBuilderConverter::convertTransform): Tell transformsForValue
that we don't require absolute lengths.

css/TransformFunctions.cpp:

(WebCore::convertToFloatLength): Add an optional parameter that will
cause the conversion to fail if the primitive value has a non-absolute
length.
(WebCore::transformsForValue): Pass the parameter for requiring an
absolute length on to convertToFloatLength when necessary.

css/TransformFunctions.h:
css/WebKitCSSMatrix.cpp:

(WebCore::WebKitCSSMatrix::setMatrixValue): In this case we do
require all transform strings to have absolute lengths, not ones
that depend on the font size or are calculated.

LayoutTests:

Update existing tests to exercise the non-absolute lengths for translation
and perspective functions.

transforms/cssmatrix-2d-interface-expected.txt:
transforms/cssmatrix-2d-interface.xhtml:
transforms/cssmatrix-3d-interface-expected.txt:
transforms/cssmatrix-3d-interface.xhtml:

6:04 PM Changeset in webkit [196737] by Ryan Haddad

3 edits in trunk/Source/WebCore

Unreviewed, rolling out r196712.
https://bugs.webkit.org/show_bug.cgi?id=154371

This change caused 5 API test failures on ios-simulator
(Requested by ryanhaddad on #webkit).

Reverted changeset:

"[iOS] Purge GraphicsServices font cache on memory warning."
https://bugs.webkit.org/show_bug.cgi?id=154343
http://trac.webkit.org/changeset/196712

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-17

5:38 PM Changeset in webkit [196736] by commit-queue@webkit.org

14 edits in trunk/Source/JavaScriptCore

[JSC] ARM64: Support the immediate format used for bit operations in Air
https://bugs.webkit.org/show_bug.cgi?id=154327

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-17
Reviewed by Filip Pizlo.

ARM64 supports a pretty rich form of immediates for bit operation.
There are two formats used to encode repeating patterns and common
input in a dense form.

In this patch, I add 2 new type of Arg: BitImm32 and BitImm64.
Those represents the valid immediate forms for bit operation.
On x86, any 32bits value is valid. On ARM64, all the encoding
form are tried and the immediate is used when possible.

The arg type Imm64 is renamed to BigImm to better represent what
it is: an immediate that does not fit into Imm.

assembler/ARM64Assembler.h:

(JSC::LogicalImmediate::create32): Deleted.
(JSC::LogicalImmediate::create64): Deleted.
(JSC::LogicalImmediate::value): Deleted.
(JSC::LogicalImmediate::isValid): Deleted.
(JSC::LogicalImmediate::is64bit): Deleted.
(JSC::LogicalImmediate::LogicalImmediate): Deleted.
(JSC::LogicalImmediate::mask): Deleted.
(JSC::LogicalImmediate::partialHSB): Deleted.
(JSC::LogicalImmediate::highestSetBit): Deleted.
(JSC::LogicalImmediate::findBitRange): Deleted.
(JSC::LogicalImmediate::encodeLogicalImmediate): Deleted.

assembler/AssemblerCommon.h:

(JSC::ARM64LogicalImmediate::create32):
(JSC::ARM64LogicalImmediate::create64):
(JSC::ARM64LogicalImmediate::value):
(JSC::ARM64LogicalImmediate::isValid):
(JSC::ARM64LogicalImmediate::is64bit):
(JSC::ARM64LogicalImmediate::ARM64LogicalImmediate):
(JSC::ARM64LogicalImmediate::mask):
(JSC::ARM64LogicalImmediate::partialHSB):
(JSC::ARM64LogicalImmediate::highestSetBit):
(JSC::ARM64LogicalImmediate::findBitRange):
(JSC::ARM64LogicalImmediate::encodeLogicalImmediate):

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::and64):
(JSC::MacroAssemblerARM64::or64):
(JSC::MacroAssemblerARM64::xor64):

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::bitImm):
(JSC::B3::Air::LowerToAir::bitImm64):
(JSC::B3::Air::LowerToAir::appendBinOp):

b3/air/AirArg.cpp:

(JSC::B3::Air::Arg::dump):
(WTF::printInternal):

b3/air/AirArg.h:

(JSC::B3::Air::Arg::bitImm):
(JSC::B3::Air::Arg::bitImm64):
(JSC::B3::Air::Arg::isBitImm):
(JSC::B3::Air::Arg::isBitImm64):
(JSC::B3::Air::Arg::isSomeImm):
(JSC::B3::Air::Arg::value):
(JSC::B3::Air::Arg::isGP):
(JSC::B3::Air::Arg::isFP):
(JSC::B3::Air::Arg::hasType):
(JSC::B3::Air::Arg::isValidBitImmForm):
(JSC::B3::Air::Arg::isValidBitImm64Form):
(JSC::B3::Air::Arg::isValidForm):
(JSC::B3::Air::Arg::asTrustedImm32):
(JSC::B3::Air::Arg::asTrustedImm64):

b3/air/AirOpcode.opcodes:
b3/air/opcode_generator.rb:

5:25 PM Changeset in webkit [196735] by beidson@apple.com

11 edits
4 moves in trunk/Source/WebKit2

Modern IDB: Rename some "UniqueIDBDatabase" classes that conflict with new classes in WebCore.
https://bugs.webkit.org/show_bug.cgi?id=154363.

Reviewed by Alex Christensen.

Adding "Legacy" to the front of the name fixes problems for now.

And all of this gunk will go away after Modern IDB is done, anyways.

CMakeLists.txt:
DatabaseProcess/DatabaseProcess.cpp:

(WebKit::DatabaseProcess::getOrCreateLegacyUniqueIDBDatabase):
(WebKit::DatabaseProcess::removeLegacyUniqueIDBDatabase):
(WebKit::DatabaseProcess::getOrCreateUniqueIDBDatabase): Deleted.
(WebKit::DatabaseProcess::removeUniqueIDBDatabase): Deleted.

DatabaseProcess/DatabaseProcess.h:
DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.cpp:

(WebKit::DatabaseProcessIDBConnection::establishConnection):

DatabaseProcess/IndexedDB/DatabaseProcessIDBConnection.h:
DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.cpp: Renamed from Source/WebKit2/DatabaseProcess/IndexedDB/UniqueIDBDatabase.cpp.

(WebKit::LegacyUniqueIDBDatabase::calculateAbsoluteDatabaseFilename):
(WebKit::LegacyUniqueIDBDatabase::LegacyUniqueIDBDatabase):
(WebKit::LegacyUniqueIDBDatabase::~LegacyUniqueIDBDatabase):
(WebKit::LegacyUniqueIDBDatabase::filenameForDatabaseName):
(WebKit::LegacyUniqueIDBDatabase::databaseFilenameIdentifier):
(WebKit::LegacyUniqueIDBDatabase::canShareDatabases):
(WebKit::LegacyUniqueIDBDatabase::registerConnection):
(WebKit::LegacyUniqueIDBDatabase::unregisterConnection):
(WebKit::LegacyUniqueIDBDatabase::shutdown):
(WebKit::LegacyUniqueIDBDatabase::shutdownBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didShutdownBackingStore):
(WebKit::LegacyUniqueIDBDatabase::deleteDatabase):
(WebKit::LegacyUniqueIDBDatabase::getOrEstablishIDBDatabaseMetadata):
(WebKit::LegacyUniqueIDBDatabase::openBackingStoreAndReadMetadata):
(WebKit::LegacyUniqueIDBDatabase::didOpenBackingStoreAndReadMetadata):
(WebKit::LegacyUniqueIDBDatabase::openTransaction):
(WebKit::LegacyUniqueIDBDatabase::beginTransaction):
(WebKit::LegacyUniqueIDBDatabase::commitTransaction):
(WebKit::LegacyUniqueIDBDatabase::resetTransaction):
(WebKit::LegacyUniqueIDBDatabase::rollbackTransaction):
(WebKit::LegacyUniqueIDBDatabase::postTransactionOperation):
(WebKit::LegacyUniqueIDBDatabase::didCompleteTransactionOperation):
(WebKit::LegacyUniqueIDBDatabase::changeDatabaseVersion):
(WebKit::LegacyUniqueIDBDatabase::didChangeDatabaseVersion):
(WebKit::LegacyUniqueIDBDatabase::didCreateObjectStore):
(WebKit::LegacyUniqueIDBDatabase::didDeleteObjectStore):
(WebKit::LegacyUniqueIDBDatabase::didClearObjectStore):
(WebKit::LegacyUniqueIDBDatabase::didCreateIndex):
(WebKit::LegacyUniqueIDBDatabase::didDeleteIndex):
(WebKit::LegacyUniqueIDBDatabase::didCompleteBoolRequest):
(WebKit::LegacyUniqueIDBDatabase::createObjectStore):
(WebKit::LegacyUniqueIDBDatabase::deleteObjectStore):
(WebKit::LegacyUniqueIDBDatabase::clearObjectStore):
(WebKit::LegacyUniqueIDBDatabase::createIndex):
(WebKit::LegacyUniqueIDBDatabase::deleteIndex):
(WebKit::LegacyUniqueIDBDatabase::putRecord):
(WebKit::LegacyUniqueIDBDatabase::getRecord):
(WebKit::LegacyUniqueIDBDatabase::openCursor):
(WebKit::LegacyUniqueIDBDatabase::cursorAdvance):
(WebKit::LegacyUniqueIDBDatabase::cursorIterate):
(WebKit::LegacyUniqueIDBDatabase::count):
(WebKit::LegacyUniqueIDBDatabase::deleteRange):
(WebKit::LegacyUniqueIDBDatabase::openBackingStoreTransaction):
(WebKit::LegacyUniqueIDBDatabase::beginBackingStoreTransaction):
(WebKit::LegacyUniqueIDBDatabase::commitBackingStoreTransaction):
(WebKit::LegacyUniqueIDBDatabase::resetBackingStoreTransaction):
(WebKit::LegacyUniqueIDBDatabase::rollbackBackingStoreTransaction):
(WebKit::LegacyUniqueIDBDatabase::changeDatabaseVersionInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::createObjectStoreInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::deleteObjectStoreInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::clearObjectStoreInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::createIndexInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::deleteIndexInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::putRecordInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didPutRecordInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::getRecordFromBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didGetRecordFromBackingStore):
(WebKit::LegacyUniqueIDBDatabase::openCursorInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didOpenCursorInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::advanceCursorInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didAdvanceCursorInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::iterateCursorInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didIterateCursorInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::countInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didCountInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::deleteRangeInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didDeleteRangeInBackingStore):
(WebKit::LegacyUniqueIDBDatabase::didEstablishTransaction):
(WebKit::LegacyUniqueIDBDatabase::didResetTransaction):
(WebKit::LegacyUniqueIDBDatabase::resetAllTransactions):
(WebKit::LegacyUniqueIDBDatabase::finalizeRollback):
(WebKit::LegacyUniqueIDBDatabase::absoluteDatabaseDirectory):
(WebKit::LegacyUniqueIDBDatabase::postMainThreadTask):
(WebKit::LegacyUniqueIDBDatabase::performNextMainThreadTask):
(WebKit::LegacyUniqueIDBDatabase::postDatabaseTask):
(WebKit::LegacyUniqueIDBDatabase::performNextDatabaseTask):

DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabase.h: Renamed from Source/WebKit2/DatabaseProcess/IndexedDB/UniqueIDBDatabase.h.

(WebKit::LegacyUniqueIDBDatabase::create):
(WebKit::LegacyUniqueIDBDatabase::identifier):

DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.cpp: Renamed from Source/WebKit2/DatabaseProcess/IndexedDB/UniqueIDBDatabaseIdentifier.cpp.

(WebKit::LegacyUniqueIDBDatabaseIdentifier::LegacyUniqueIDBDatabaseIdentifier):
(WebKit::LegacyUniqueIDBDatabaseIdentifier::isHashTableDeletedValue):
(WebKit::LegacyUniqueIDBDatabaseIdentifier::hash):
(WebKit::LegacyUniqueIDBDatabaseIdentifier::isNull):
(WebKit::LegacyUniqueIDBDatabaseIdentifier::isolatedCopy):
(WebKit::operator==):

DatabaseProcess/IndexedDB/LegacyUniqueIDBDatabaseIdentifier.h: Renamed from Source/WebKit2/DatabaseProcess/IndexedDB/UniqueIDBDatabaseIdentifier.h.

(WebKit::LegacyUniqueIDBDatabaseIdentifier::databaseName):
(WebKit::LegacyUniqueIDBDatabaseIdentifier::openingOrigin):
(WebKit::LegacyUniqueIDBDatabaseIdentifier::mainFrameOrigin):
(WebKit::LegacyUniqueIDBDatabaseIdentifierHash::hash):
(WebKit::LegacyUniqueIDBDatabaseIdentifierHash::equal):
(WebKit::LegacyUniqueIDBDatabaseIdentifierHashTraits::isEmptyValue):

DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.cpp:

(WebKit::UniqueIDBDatabaseBackingStoreSQLite::UniqueIDBDatabaseBackingStoreSQLite):
(WebKit::UniqueIDBDatabaseBackingStoreSQLite::getOrEstablishMetadata):

DatabaseProcess/IndexedDB/sqlite/UniqueIDBDatabaseBackingStoreSQLite.h:
Shared/WebCrossThreadCopier.cpp:

(WebCore::LegacyUniqueIDBDatabaseIdentifier>::copy):
(WebCore::UniqueIDBDatabaseIdentifier>::copy): Deleted.

Shared/WebCrossThreadCopier.h:
WebKit2.xcodeproj/project.pbxproj:

5:17 PM Changeset in webkit [196734] by keith_miller@apple.com

14 edits
1 add in trunk

Spread operator should be allowed when not the first argument of parameter list
https://bugs.webkit.org/show_bug.cgi?id=152721

Reviewed by Saam Barati.

Source/JavaScriptCore:

Spread arguments to functions should now be ES6 compliant. Before we
would only take a spread operator if it was the sole argument to a
function. Additionally, we would not use the Symbol.iterator on the
object to generate the arguments. Instead we would do a loop up to the
length mapping indexed properties to the corresponding argument. We fix
both these issues by doing an AST transformation from foo(...a, b, ...c, d)
to foo(...[...a, b, ...c, d]) (where the spread on the rhs uses the
old spread semantics). This solution has the downside of requiring the
allocation of another object and copying each element twice but avoids a
large change to the vm calling convention.

interpreter/Interpreter.cpp:

(JSC::loadVarargs):

parser/ASTBuilder.h:

(JSC::ASTBuilder::createElementList):

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseArguments):
(JSC::Parser<LexerType>::parseArgument):
(JSC::Parser<LexerType>::parseMemberExpression):

parser/Parser.h:
parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createElementList):

tests/es6.yaml:
tests/stress/spread-calling.js: Added.

(testFunction):
(testEmpty):
(makeObject):
(otherIterator.return.next):
(otherIterator):
(totalIter):
(throwingIter.return.next):
(throwingIter):
(i.catch):

LayoutTests:

Update tests with new semantics of spread calling. Additionally,
adjust benchmarks to run in a more reasonable time now that
spread is implemented correctly.

js/basic-spread-expected.txt:
js/parser-syntax-check-expected.txt:
js/regress/script-tests/deltablue-varargs.js:

(deltaBlue):

js/regress/script-tests/varargs-construct.js:
js/script-tests/basic-spread.js:
js/script-tests/parser-syntax-check.js:

5:05 PM Changeset in webkit [196733] by BJ Burg

2 edits in trunk/Source/JavaScriptCore

Remove a wrong cast in RemoteInspector::receivedSetupMessage
https://bugs.webkit.org/show_bug.cgi?id=154361
<rdar://problem/24709281>

Reviewed by Joseph Pecoraro.

inspector/remote/RemoteInspector.mm:

(Inspector::RemoteInspector::receivedSetupMessage):
Not only is this cast unnecessary (the constructor accepts the base class),
but it is wrong since the target could be an automation target. Remove it.

5:03 PM Changeset in webkit [196732] by andersca@apple.com

5 edits in trunk/Source/WebKit2

Remove WebContextSupplement::shouldTerminate, it's no longer used
https://bugs.webkit.org/show_bug.cgi?id=154367

Reviewed by Sam Weinig.

UIProcess/WebContextSupplement.h:

(WebKit::WebContextSupplement::shouldTerminate): Deleted.

UIProcess/WebCookieManagerProxy.cpp:

(WebKit::WebCookieManagerProxy::shouldTerminate): Deleted.

UIProcess/WebCookieManagerProxy.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::shouldTerminate): Deleted.

4:42 PM Changeset in webkit [196731] by fpizlo@apple.com

5 edits
3 moves in trunk/Source/JavaScriptCore

Rename FTLB3Blah to FTLBlah
https://bugs.webkit.org/show_bug.cgi?id=154365

Rubber stamped by Geoffrey Garen, Benjamin Poulain, Awesome Kling, and Saam Barati.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
ftl/FTLB3Compile.cpp: Removed.
ftl/FTLB3Output.cpp: Removed.
ftl/FTLB3Output.h: Removed.
ftl/FTLCompile.cpp: Copied from Source/JavaScriptCore/ftl/FTLB3Compile.cpp.
ftl/FTLOutput.cpp: Copied from Source/JavaScriptCore/ftl/FTLB3Output.cpp.
ftl/FTLOutput.h: Copied from Source/JavaScriptCore/ftl/FTLB3Output.h.

4:37 PM Changeset in webkit [196730] by BJ Burg

2 edits in trunk/Source/WebKit2

RemoteInspector deadlocks if _WKAutomationDelegate creates/registers a target synchronously
https://bugs.webkit.org/show_bug.cgi?id=154359
<rdar://problem/24708897>

Reviewed by Joseph Pecoraro.

RemoteInspector always grabs a lock whenever receiving or sending XPC messages. If it
forwards a new session request via _WKAutomationDelegate, and the client synchronously
creates and registers a session, then RemoteInspector will try to grab the lock again
while adding the session to its registry, causing a deadlock.

UIProcess/Cocoa/AutomationClient.mm:

(WebKit::AutomationClient::requestAutomationSession): Add a dispatch_async() to
protect clients from accidentally deadlocking. They shouldn't have to care about
RemoteInspector's locking mechanisms.

4:11 PM Changeset in webkit [196729] by fpizlo@apple.com

52 edits
57 deletes in trunk

Remove LLVM dependencies from WebKit
https://bugs.webkit.org/show_bug.cgi?id=154323

Reviewed by Antti Koivisto and Benjamin Poulain.

Source/JavaScriptCore:

We have switched all ports that use the FTL JIT to using B3 as the backend. This renders all
LLVM-related code dead, including the disassembler, which was only reachable when you were on
a platform that already had an in-tree disassembler.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
dfg/DFGCommon.h:
dfg/DFGPlan.cpp:

(JSC::DFG::Plan::compileInThread):
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::compileTimeStats):

disassembler/ARM64Disassembler.cpp:

(JSC::tryToDisassemble):

disassembler/ARMv7Disassembler.cpp:

(JSC::tryToDisassemble):

disassembler/Disassembler.cpp:

(JSC::disassemble):
(JSC::disassembleAsynchronously):

disassembler/Disassembler.h:

(JSC::tryToDisassemble):

disassembler/LLVMDisassembler.cpp: Removed.
disassembler/LLVMDisassembler.h: Removed.
disassembler/UDis86Disassembler.cpp:

(JSC::tryToDisassembleWithUDis86):

disassembler/UDis86Disassembler.h:

(JSC::tryToDisassembleWithUDis86):

disassembler/X86Disassembler.cpp:

(JSC::tryToDisassemble):

ftl/FTLAbbreviatedTypes.h:
ftl/FTLAbbreviations.h: Removed.
ftl/FTLAbstractHeap.cpp:

(JSC::FTL::AbstractHeap::decorateInstruction):
(JSC::FTL::AbstractHeap::dump):
(JSC::FTL::AbstractField::dump):
(JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
(JSC::FTL::IndexedAbstractHeap::~IndexedAbstractHeap):
(JSC::FTL::IndexedAbstractHeap::baseIndex):
(JSC::FTL::IndexedAbstractHeap::dump):
(JSC::FTL::NumberedAbstractHeap::NumberedAbstractHeap):
(JSC::FTL::NumberedAbstractHeap::dump):
(JSC::FTL::AbsoluteAbstractHeap::AbsoluteAbstractHeap):
(JSC::FTL::AbstractHeap::tbaaMetadataSlow): Deleted.

ftl/FTLAbstractHeap.h:

(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::heapName):
(JSC::FTL::IndexedAbstractHeap::atAnyIndex):
(JSC::FTL::NumberedAbstractHeap::atAnyNumber):
(JSC::FTL::AbsoluteAbstractHeap::atAnyAddress):
(JSC::FTL::AbstractHeap::tbaaMetadata): Deleted.

ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):

ftl/FTLAbstractHeapRepository.h:
ftl/FTLB3Compile.cpp:
ftl/FTLB3Output.cpp:

(JSC::FTL::Output::Output):
(JSC::FTL::Output::check):
(JSC::FTL::Output::load):
(JSC::FTL::Output::store):

ftl/FTLB3Output.h:
ftl/FTLCommonValues.cpp:

(JSC::FTL::CommonValues::CommonValues):
(JSC::FTL::CommonValues::initializeConstants):

ftl/FTLCommonValues.h:

(JSC::FTL::CommonValues::initialize): Deleted.

ftl/FTLCompile.cpp: Removed.
ftl/FTLCompileBinaryOp.cpp: Removed.
ftl/FTLCompileBinaryOp.h: Removed.
ftl/FTLDWARFDebugLineInfo.cpp: Removed.
ftl/FTLDWARFDebugLineInfo.h: Removed.
ftl/FTLDWARFRegister.cpp: Removed.
ftl/FTLDWARFRegister.h: Removed.
ftl/FTLDataSection.cpp: Removed.
ftl/FTLDataSection.h: Removed.
ftl/FTLExceptionHandlerManager.cpp: Removed.
ftl/FTLExceptionHandlerManager.h: Removed.
ftl/FTLExceptionTarget.cpp:
ftl/FTLExceptionTarget.h:
ftl/FTLExitThunkGenerator.cpp: Removed.
ftl/FTLExitThunkGenerator.h: Removed.
ftl/FTLFail.cpp:

(JSC::FTL::fail):

ftl/FTLInlineCacheDescriptor.h: Removed.
ftl/FTLInlineCacheSize.cpp: Removed.
ftl/FTLInlineCacheSize.h: Removed.
ftl/FTLIntrinsicRepository.cpp: Removed.
ftl/FTLIntrinsicRepository.h: Removed.
ftl/FTLJITCode.cpp:

(JSC::FTL::JITCode::~JITCode):
(JSC::FTL::JITCode::initializeB3Code):
(JSC::FTL::JITCode::initializeB3Byproducts):
(JSC::FTL::JITCode::initializeAddressForCall):
(JSC::FTL::JITCode::contains):
(JSC::FTL::JITCode::ftl):
(JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
(JSC::FTL::JITCode::initializeExitThunks): Deleted.
(JSC::FTL::JITCode::addHandle): Deleted.
(JSC::FTL::JITCode::addDataSection): Deleted.
(JSC::FTL::JITCode::exitThunks): Deleted.

ftl/FTLJITCode.h:

(JSC::FTL::JITCode::b3Code):
(JSC::FTL::JITCode::handles): Deleted.
(JSC::FTL::JITCode::dataSections): Deleted.

ftl/FTLJITFinalizer.cpp:

(JSC::FTL::JITFinalizer::codeSize):
(JSC::FTL::JITFinalizer::finalizeFunction):

ftl/FTLJITFinalizer.h:
ftl/FTLJSCall.cpp: Removed.
ftl/FTLJSCall.h: Removed.
ftl/FTLJSCallBase.cpp: Removed.
ftl/FTLJSCallBase.h: Removed.
ftl/FTLJSCallVarargs.cpp: Removed.
ftl/FTLJSCallVarargs.h: Removed.
ftl/FTLJSTailCall.cpp: Removed.
ftl/FTLJSTailCall.h: Removed.
ftl/FTLLazySlowPath.cpp:

(JSC::FTL::LazySlowPath::LazySlowPath):
(JSC::FTL::LazySlowPath::generate):

ftl/FTLLazySlowPath.h:

(JSC::FTL::LazySlowPath::createGenerator):
(JSC::FTL::LazySlowPath::patchableJump):
(JSC::FTL::LazySlowPath::done):
(JSC::FTL::LazySlowPath::usedRegisters):
(JSC::FTL::LazySlowPath::callSiteIndex):
(JSC::FTL::LazySlowPath::stub):
(JSC::FTL::LazySlowPath::patchpoint): Deleted.

ftl/FTLLink.cpp:

(JSC::FTL::link):

ftl/FTLLocation.cpp:

(JSC::FTL::Location::forValueRep):
(JSC::FTL::Location::dump):
(JSC::FTL::Location::forStackmaps): Deleted.

ftl/FTLLocation.h:

(JSC::FTL::Location::forRegister):
(JSC::FTL::Location::forIndirect):
(JSC::FTL::Location::forConstant):
(JSC::FTL::Location::kind):
(JSC::FTL::Location::hasReg):

ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::LowerDFGToLLVM):
(JSC::FTL::DFG::LowerDFGToLLVM::lower):
(JSC::FTL::DFG::LowerDFGToLLVM::createPhiVariables):
(JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
(JSC::FTL::DFG::LowerDFGToLLVM::compileUpsilon):
(JSC::FTL::DFG::LowerDFGToLLVM::compilePhi):
(JSC::FTL::DFG::LowerDFGToLLVM::compileDoubleConstant):
(JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd):
(JSC::FTL::DFG::LowerDFGToLLVM::compileStrCat):
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithDiv):
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithNegate):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitAnd):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitOr):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitXor):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitRShift):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitLShift):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitURShift):
(JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
(JSC::FTL::DFG::LowerDFGToLLVM::compileGetButterfly):
(JSC::FTL::DFG::LowerDFGToLLVM::compileMakeRope):
(JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
(JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
(JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
(JSC::FTL::DFG::LowerDFGToLLVM::compileLoadVarargs):
(JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
(JSC::FTL::DFG::LowerDFGToLLVM::compileIsUndefined):
(JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
(JSC::FTL::DFG::LowerDFGToLLVM::getById):
(JSC::FTL::DFG::LowerDFGToLLVM::loadButterflyWithBarrier):
(JSC::FTL::DFG::LowerDFGToLLVM::stringsEqual):
(JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
(JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
(JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
(JSC::FTL::DFG::LowerDFGToLLVM::speculate):
(JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
(JSC::FTL::DFG::LowerDFGToLLVM::preparePatchpointForExceptions):
(JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
(JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
(JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
(JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
(JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
(JSC::FTL::DFG::LowerDFGToLLVM::exitValueForAvailability):
(JSC::FTL::DFG::LowerDFGToLLVM::exitValueForNode):
(JSC::FTL::DFG::LowerDFGToLLVM::probe):
(JSC::FTL::DFG::LowerDFGToLLVM::crash):
(JSC::FTL::DFG::LowerDFGToLLVM::compileUntypedBinaryOp): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::callStackmap): Deleted.

ftl/FTLOSRExit.cpp:

(JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
(JSC::FTL::OSRExitDescriptor::validateReferences):
(JSC::FTL::OSRExitDescriptor::emitOSRExit):
(JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
(JSC::FTL::OSRExit::OSRExit):
(JSC::FTL::OSRExit::codeLocationForRepatch):
(JSC::FTL::OSRExit::gatherRegistersToSpillForCallIfException): Deleted.
(JSC::FTL::OSRExit::spillRegistersToSpillSlot): Deleted.
(JSC::FTL::OSRExit::recoverRegistersFromSpillSlot): Deleted.
(JSC::FTL::OSRExit::willArriveAtExitFromIndirectExceptionCheck): Deleted.
(JSC::FTL::OSRExit::willArriveAtOSRExitFromCallOperation): Deleted.
(JSC::FTL::OSRExit::needsRegisterRecoveryOnGenericUnwindOSRExitPath): Deleted.

ftl/FTLOSRExit.h:

(JSC::FTL::OSRExit::considerAddingAsFrequentExitSite):
(JSC::FTL::OSRExitDescriptorImpl::OSRExitDescriptorImpl): Deleted.

ftl/FTLOSRExitCompilationInfo.h: Removed.
ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileRecovery):
(JSC::FTL::compileStub):
(JSC::FTL::compileFTLOSRExit):

ftl/FTLOSRExitHandle.cpp:
ftl/FTLOSRExitHandle.h:
ftl/FTLOutput.cpp: Removed.
ftl/FTLOutput.h: Removed.
ftl/FTLPatchpointExceptionHandle.cpp:
ftl/FTLPatchpointExceptionHandle.h:
ftl/FTLStackMaps.cpp: Removed.
ftl/FTLStackMaps.h: Removed.
ftl/FTLState.cpp:

(JSC::FTL::State::State):
(JSC::FTL::State::~State):
(JSC::FTL::State::dumpState): Deleted.

ftl/FTLState.h:
ftl/FTLUnwindInfo.cpp: Removed.
ftl/FTLUnwindInfo.h: Removed.
ftl/FTLValueRange.cpp:

(JSC::FTL::ValueRange::decorateInstruction):

ftl/FTLValueRange.h:

(JSC::FTL::ValueRange::ValueRange):
(JSC::FTL::ValueRange::begin):
(JSC::FTL::ValueRange::end):

ftl/FTLWeight.h:

(JSC::FTL::Weight::value):
(JSC::FTL::Weight::frequencyClass):
(JSC::FTL::Weight::scaleToTotal):

llvm/InitializeLLVM.cpp: Removed.
llvm/InitializeLLVM.h: Removed.
llvm/InitializeLLVMMac.cpp: Removed.
llvm/InitializeLLVMPOSIX.cpp: Removed.
llvm/InitializeLLVMPOSIX.h: Removed.
llvm/LLVMAPI.cpp: Removed.
llvm/LLVMAPI.h: Removed.
llvm/LLVMAPIFunctions.h: Removed.
llvm/LLVMHeaders.h: Removed.
llvm/library/LLVMAnchor.cpp: Removed.
llvm/library/LLVMExports.cpp: Removed.
llvm/library/LLVMOverrides.cpp: Removed.
llvm/library/config_llvm.h: Removed.

Source/WTF:

wtf/Platform.h:

Tools:

Scripts/copy-webkitlibraries-to-product-directory:

(isContentOfFileEqualToString):
(fileContains): Deleted.
(buildLLVM): Deleted.
(symlinkLLVMLibrariesIfNeeded): Deleted.

WebKitLibraries:

LLVMIncludesElCapitan.tar.bz2: Removed.
LLVMIncludesIOS9.tar.bz2: Removed.
LLVMIncludesMavericks.tar.bz2: Removed.
LLVMIncludesYosemite.tar.bz2: Removed.
LLVMLibrariesElCapitan.tar.bz2: Removed.
LLVMLibrariesIOS9.tar.bz2: Removed.
LLVMLibrariesMavericks.tar.bz2: Removed.
LLVMLibrariesYosemite.tar.bz2: Removed.

3:45 PM Changeset in webkit [196728] by andersca@apple.com

3 edits in trunk/Source/WebKit2

Remove an unused function
https://bugs.webkit.org/show_bug.cgi?id=154358

Reviewed by Sam Weinig.

Platform/cg/CGUtilities.cpp:

(WebKit::paintBitmapContext): Deleted.

Platform/cg/CGUtilities.h:

3:36 PM Changeset in webkit [196727] by Ryan Haddad

1 edit
2 adds in trunk/LayoutTests

Add ios-simulator baseline for new W3C HTML tests added with r196710

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt: Added.
platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt: Added.

3:35 PM Changeset in webkit [196726] by commit-queue@webkit.org

6 edits
2 adds in trunk/Source/JavaScriptCore

[JSC] Remove the overflow check on ArithAbs when possible
https://bugs.webkit.org/show_bug.cgi?id=154325

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-17
Reviewed by Filip Pizlo.

This patch adds support for ArithMode for ArithAbs.

It is useful for kraken tests where Math.abs() is used
on values for which the range is known.

For example, imaging-gaussian-blur has two Math.abs() with
integers that are always in a small range around zero.
The IntegerRangeOptimizationPhase detects the range correctly
so we can just update the ArithMode depending on the input.

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGIntegerRangeOptimizationPhase.cpp:
dfg/DFGNode.h:

(JSC::DFG::Node::convertToArithNegate):
(JSC::DFG::Node::hasArithMode):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileArithAbs):

tests/stress/arith-abs-integer-range-optimization.js: Added.

(negativeRange):
(negativeRangeIncludingZero):
(negativeRangeWithOverflow):
(positiveRange):
(positiveRangeIncludingZero):
(rangeWithoutOverflow):

tests/stress/arith-abs-with-bitwise-or-zero.js: Added.

(opaqueAbs):

3:25 PM Changeset in webkit [196725] by beidson@apple.com

10 edits in trunk/Source

Modern IDB: More Encoder/Decoder/Messaging scaffolding for WK2 IPC.
https://bugs.webkit.org/show_bug.cgi?id=154356

Reviewed by Alex Christensen.

No change in behavior yet; Just laying the groundwork.

Source/WebCore:

Modules/indexeddb/shared/IDBDatabaseInfo.h:

(WebCore::IDBDatabaseInfo::encode):
(WebCore::IDBDatabaseInfo::decode):

Modules/indexeddb/shared/IDBError.h:

(WebCore::IDBError::encode):
(WebCore::IDBError::decode):

Modules/indexeddb/shared/IDBRequestData.h:

(WebCore::IDBRequestData::decode):

Modules/indexeddb/shared/IDBResultData.h:

(WebCore::IDBResultData::encode):
(WebCore::IDBResultData::decode):

Source/WebKit2:

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.cpp:

(WebKit::WebIDBConnectionToClient::didDeleteDatabase):
(WebKit::WebIDBConnectionToClient::didOpenDatabase):
(WebKit::WebIDBConnectionToClient::didAbortTransaction):
(WebKit::WebIDBConnectionToClient::didCommitTransaction):
(WebKit::WebIDBConnectionToClient::didCreateObjectStore):
(WebKit::WebIDBConnectionToClient::didDeleteObjectStore):
(WebKit::WebIDBConnectionToClient::didClearObjectStore):
(WebKit::WebIDBConnectionToClient::didCreateIndex):
(WebKit::WebIDBConnectionToClient::didDeleteIndex):
(WebKit::WebIDBConnectionToClient::didPutOrAdd):
(WebKit::WebIDBConnectionToClient::didGetRecord):
(WebKit::WebIDBConnectionToClient::didGetCount):
(WebKit::WebIDBConnectionToClient::didDeleteRecord):
(WebKit::WebIDBConnectionToClient::didOpenCursor):
(WebKit::WebIDBConnectionToClient::didIterateCursor):
(WebKit::WebIDBConnectionToClient::fireVersionChangeEvent):
(WebKit::WebIDBConnectionToClient::didStartTransaction):
(WebKit::WebIDBConnectionToClient::notifyOpenDBRequestBlocked):

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.h:
WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.messages.in:

3:11 PM Changeset in webkit [196724] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

Fix GTK build after r196720.

UIProcess/API/gtk/WebKitUIClient.cpp:

2:59 PM Changeset in webkit [196723] by Chris Dumez

3 edits
2 adds in trunk

SES selftest page crashes on nightly r196694
https://bugs.webkit.org/show_bug.cgi?id=154350
<rdar://problem/24704334>

Reviewed by Mark Lam.

Source/JavaScriptCore:

SES selftest page crashes after r196001 / r196145 when calling
Object.getOwnPropertyDescriptor(window, "length") after the window
has been reified and "length" has been shadowed by a value property.

It was crashing in JSObject::getOwnPropertyDescriptor() because
we are getting a slot that has attribute "CustomAccessor" but
the property is not a CustomGetterSetter. In this case, since
window.length is [Replaceable] and has been set to a numeric value,
it makes that the property is not a CustomGetterSetter. However,
the "CustomAccessor" attribute should have been dropped from the
slot when window.length was shadowed. Therefore, this code path
should not be exercised at all when calling
getOwnPropertyDescriptor().

The issue was that putDirectInternal() was updating the slot
attributes only if the "Accessor" flag has changed, but not
the "customAccessor" flag. This patch fixes the issue.

runtime/JSObject.h:

(JSC::JSObject::putDirectInternal):

LayoutTests:

Add test coverage for the crash which happens when shadowing window.length
with a value after the window property and then calling
Object.getOwnPropertyDescriptor(window, "length").

js/window-length-getOwnPropertyDescriptor-crash-expected.txt: Added.
js/window-length-getOwnPropertyDescriptor-crash.html: Added.

2:11 PM Changeset in webkit [196722] by sbarati@apple.com

36 edits
8 adds in trunk/Source

Implement Proxy Get
https://bugs.webkit.org/show_bug.cgi?id=154081

Reviewed by Michael Saboff.

Source/JavaScriptCore:

This patch implements ProxyObject and ProxyConstructor. Their
implementations are straight forward and follow the spec.
The largest change in this patch is adding a second parameter
to PropertySlot's constructor that specifies the internal method type of
the getOwnPropertySlot inquiry. We use getOwnPropertySlot to
implement more than one Internal Method in the spec. Because
of this, we need InternalMethodType to give us context about
which Internal Method we're executing. Specifically, Proxy will
call into different handlers based on this information.

InternalMethodType is an enum with the following values:

Get This corresponds to Get internal method in the spec.
GetOwnProperty This corresponds to GetOwnProperty internal method in the spec.
HasProperty This corresponds to HasProperty internal method in the spec.
VMInquiry This is basically everything else that isn't one of the above types. This value also mandates that getOwnPropertySlot does not perform any user observable effects. I.e, it can't call a JS function.

The other non-VMInquiry InternalMethodTypes are allowed to perform user
observable effects. I.e, in future patches, ProxyObject will implement
InternalMethodType::HasProperty and InternalMethodType::GetOwnProperty, which will both be defined
to call user defined JS functions, which clearly have the right to perform
user observable effects.

This patch implements getOwnPropertySlot of ProxyObject under
InternalMethodType::Get.

API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject<Parent>::put):
(JSC::JSCallbackObject<Parent>::staticFunctionGetter):

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
debugger/DebuggerScope.cpp:

(JSC::DebuggerScope::caughtValue):

interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):

jit/JITOperations.cpp:
llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

runtime/ArrayPrototype.cpp:

(JSC::getProperty):

runtime/CommonIdentifiers.h:
runtime/JSCJSValueInlines.h:

(JSC::JSValue::get):

runtime/JSFunction.cpp:

(JSC::JSFunction::getOwnNonIndexPropertyNames):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):

runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayViewWithArguments):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::defineOwnProperty):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::regExpMatchesArrayStructure):
(JSC::JSGlobalObject::moduleRecordStructure):
(JSC::JSGlobalObject::moduleNamespaceObjectStructure):
(JSC::JSGlobalObject::proxyObjectStructure):
(JSC::JSGlobalObject::wasmModuleStructure):

runtime/JSModuleEnvironment.cpp:

(JSC::JSModuleEnvironment::getOwnPropertySlot):

runtime/JSModuleNamespaceObject.cpp:

(JSC::callbackGetter):

runtime/JSONObject.cpp:

(JSC::Stringifier::Holder::appendNextProperty):
(JSC::Walker::walk):

runtime/JSObject.cpp:

(JSC::JSObject::calculatedClassName):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::hasProperty):
(JSC::JSObject::deleteProperty):
(JSC::JSObject::hasOwnProperty):
(JSC::JSObject::getOwnPropertyDescriptor):

runtime/JSObject.h:

(JSC::JSObject::getDirectIndex):
(JSC::JSObject::get):

runtime/JSScope.cpp:

(JSC::abstractAccess):

runtime/ObjectConstructor.cpp:

(JSC::toPropertyDescriptor):

runtime/ObjectPrototype.cpp:

(JSC::objectProtoFuncLookupGetter):
(JSC::objectProtoFuncLookupSetter):
(JSC::objectProtoFuncToString):

runtime/PropertySlot.h:

(JSC::attributesForStructure):
(JSC::PropertySlot::PropertySlot):
(JSC::PropertySlot::isCacheableGetter):
(JSC::PropertySlot::isCacheableCustom):
(JSC::PropertySlot::internalMethodType):
(JSC::PropertySlot::disableCaching):
(JSC::PropertySlot::getValue):

runtime/ProxyConstructor.cpp: Added.

(JSC::ProxyConstructor::create):
(JSC::ProxyConstructor::ProxyConstructor):
(JSC::ProxyConstructor::finishCreation):
(JSC::constructProxyObject):
(JSC::ProxyConstructor::getConstructData):
(JSC::ProxyConstructor::getCallData):

runtime/ProxyConstructor.h: Added.

(JSC::ProxyConstructor::createStructure):

runtime/ProxyObject.cpp: Added.

(JSC::ProxyObject::ProxyObject):
(JSC::ProxyObject::finishCreation):
(JSC::performProxyGet):
(JSC::ProxyObject::getOwnPropertySlotCommon):
(JSC::ProxyObject::getOwnPropertySlot):
(JSC::ProxyObject::getOwnPropertySlotByIndex):
(JSC::ProxyObject::visitChildren):

runtime/ProxyObject.h: Added.

(JSC::ProxyObject::create):
(JSC::ProxyObject::createStructure):
(JSC::ProxyObject::target):
(JSC::ProxyObject::handler):

runtime/ReflectObject.cpp:

(JSC::reflectObjectGet):

runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::StackFrame::nameFromCallee):

tests/es6.yaml:
tests/stress/proxy-basic.js: Added.

(assert):
(let.handler.get null):
(get let):
(let.handler.get switch):
(let.handler):
(let.theTarget.get x):

tests/stress/proxy-in-proto-chain.js: Added.

(assert):

tests/stress/proxy-of-a-proxy.js: Added.

(assert):
(throw.new.Error.):

tests/stress/proxy-property-descriptor.js: Added.

(assert):
(set Object):

wasm/WASMModuleParser.cpp:

(JSC::WASMModuleParser::getImportedValue):

Source/WebCore:

Tests are in JavaScriptCore.

bindings/js/JSCryptoAlgorithmDictionary.cpp:

(WebCore::getProperty):
(WebCore::getHashAlgorithm):

bindings/js/JSCryptoKeySerializationJWK.cpp:

(WebCore::getJSArrayFromJSON):
(WebCore::getStringFromJSON):
(WebCore::getBooleanFromJSON):

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::DialogHandler::returnValue):

bindings/js/JSDictionary.cpp:

(WebCore::JSDictionary::tryGetProperty):

bindings/js/JSStorageCustom.cpp:

(WebCore::JSStorage::deleteProperty):
(WebCore::JSStorage::deletePropertyByIndex):
(WebCore::JSStorage::putDelegate):

bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::getProperty):

testing/Internals.cpp:

(WebCore::Internals::isReadableStreamDisturbed):

2:03 PM Changeset in webkit [196721] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

StringPrototype functions should check for exceptions after calling JSString::value().
https://bugs.webkit.org/show_bug.cgi?id=154340

Reviewed by Filip Pizlo.

JSString::value() can throw an exception if the JS string is a rope and value()
needs to resolve the rope but encounters an OutOfMemory error. If value() is not
able to resolve the rope, it will return a null string (in addition to throwing
the exception). If StringPrototype functions do not check for exceptions after
calling JSString::value(), they may eventually use the returned null string and
crash the VM.

The fix is to add all the necessary exception checks, and do the appropriate
handling if needed.

Also in a few place where when an exception is detected, we return JSValue(), I
changed it to return jsUndefined() instead to be consistent with the rest of the
file.

runtime/StringPrototype.cpp:

(JSC::replaceUsingRegExpSearch):
(JSC::stringProtoFuncMatch):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSplit):
(JSC::stringProtoFuncLocaleCompare):
(JSC::stringProtoFuncBig):
(JSC::stringProtoFuncSmall):
(JSC::stringProtoFuncBlink):
(JSC::stringProtoFuncBold):
(JSC::stringProtoFuncFixed):
(JSC::stringProtoFuncItalics):
(JSC::stringProtoFuncStrike):
(JSC::stringProtoFuncSub):
(JSC::stringProtoFuncSup):
(JSC::stringProtoFuncFontcolor):
(JSC::stringProtoFuncFontsize):
(JSC::stringProtoFuncAnchor):
(JSC::stringProtoFuncLink):
(JSC::trimString):

1:46 PM Changeset in webkit [196720] by andersca@apple.com

9 edits in trunk/Source/WebKit2

Need listener-based version of runBeforeUnloadConfirmPanel
https://bugs.webkit.org/show_bug.cgi?id=154354
rdar://problem/23736691

Reviewed by Sam Weinig.

Shared/API/APIObject.h:
Shared/API/c/WKBase.h:
UIProcess/API/APIUIClient.h:

(API::UIClient::runBeforeUnloadConfirmPanel):

UIProcess/API/C/WKPage.cpp:

(fixUpBotchedPageUIClient):
(WebKit::RunBeforeUnloadConfirmPanelResultListener::create):
(WebKit::RunBeforeUnloadConfirmPanelResultListener::~RunBeforeUnloadConfirmPanelResultListener):
(WebKit::RunBeforeUnloadConfirmPanelResultListener::call):
(WKPageRunBeforeUnloadConfirmPanelResultListenerGetTypeID):
(WKPageRunBeforeUnloadConfirmPanelResultListenerCall):
(WKPageSetPageUIClient):

UIProcess/API/C/WKPageUIClient.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::runBeforeUnloadConfirmPanel):

UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:

1:44 PM Changeset in webkit [196719] by Simon Fraser

5 edits in trunk/LayoutTests

Add tests for iframe and overflow scrollability after navigating back
https://bugs.webkit.org/show_bug.cgi?id=154300

Fix the tests added in r196665 to be agnostic about how many pixels a wheel event scrolls.

fast/scrolling/iframe-scrollable-after-back-expected.txt:
fast/scrolling/iframe-scrollable-after-back.html:
fast/scrolling/overflow-scrollable-after-back-expected.txt:
fast/scrolling/overflow-scrollable-after-back.html:

1:33 PM Changeset in webkit [196718] by commit-queue@webkit.org

1 edit
3 adds in trunk/LayoutTests

[ES6] Arrow function. Arrow function should raise exception ReferenceError only when access to 'arguments' on top level
https://bugs.webkit.org/show_bug.cgi?id=152570

Patch by Skachkov Oleksandr <gskachkov@gmail.com> on 2016-02-17
Reviewed by Saam Barati.

Add tests to ensure that arrrow function return error when it binds arguments on top level

js/arrowfunction-lexical-bind-arguments-top-level-expected.txt: Added.
js/arrowfunction-lexical-bind-arguments-top-level.html: Added.
js/script-tests/arrowfunction-lexical-bind-arguments-top-level.js: Added.

1:27 PM Changeset in webkit [196717] by Simon Fraser

11 edits in trunk/Source

PDFPlugin's scrollableArea container is not properly unregistered when page is going into the PageCache
https://bugs.webkit.org/show_bug.cgi?id=148182

Reviewed by Brent Fulgham.
Source/WebCore:

When handling Command-arrow key while showing a scrollable PDF, the timing of PDFPlugin
teardown and navigation could result in PDFPlugin::destroy() getting the wrong FrameView,
so the old FrameView was left with a stale pointer in its scrollableAreaSet.

Fix this by adding an explicit willDetatchRenderer() which is called on the plugin
before the Frame gets a new FrameView.

Also narrow the scope of the RefPtr<Widget> in HTMLPlugInElement::defaultEventHandler()
so that the Widget is not kept alive over a possible navigation.

I was unable to make an automated test, because reproducing the bug requires handling
a Command-arrow key event in a way that the last ref to a Widget is held over the event
handling, and this wasn't possible in an iframe.

html/HTMLPlugInElement.cpp:

(WebCore::HTMLPlugInElement::defaultEventHandler):

html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::willDetachRenderers):

plugins/PluginViewBase.h:

(WebCore::PluginViewBase::willDetatchRenderer):

style/StyleTreeResolver.cpp:

(WebCore::Style::detachRenderTree): Drive-by nullptr.

Source/WebKit2:

Fix this by adding an explicit willDetatchRenderer() which is called on the plugin
before the Frame gets a new FrameView.

Also narrow the scope of the RefPtr<Widget> in HTMLPlugInElement::defaultEventHandler()
so that the Widget is not kept alive over a possible navigation.

WebProcess/Plugins/PDF/DeprecatedPDFPlugin.h:
WebProcess/Plugins/PDF/DeprecatedPDFPlugin.mm:

(WebKit::PDFPlugin::willDetatchRenderer):

WebProcess/Plugins/Plugin.h:

(WebKit::Plugin::willDetatchRenderer):

WebProcess/Plugins/PluginView.cpp:

(WebKit::PluginView::willDetatchRenderer):

WebProcess/Plugins/PluginView.h:

1:17 PM Changeset in webkit [196716] by weinig@apple.com

4 edits in trunk

Add an ensure function on HashMap that takes a key and a function to make the lazy value initialization idiom easier
https://bugs.webkit.org/show_bug.cgi?id=134857

Reviewed by Geoffrey Garen.

Source/WTF:

The current idiom for adding a value to a HashMap if the key is not already present, to allow for not
unnecessarily constructing the new value if it won't be used, is:

{

auto result = map.add(key, Value());
if (!result.isNewEntry)

return result.iterator->value;

result.iterator->value = createNewValue();
return result.iterator->value;

}

or sometimes

{

auto& value = map.add(key, Value()).iterator->value;
if (!value)

value = createNewValue();

return value;

}

With this patch, you can now use the new function HashMap::ensure(key, functor). This will allow us to
change to using the following idiom:

{

return map.ensure(key, [] { return createNewValue(); });

}

The passed in functor will only be called if the key is not already present in the HashMap.

wtf/HashMap.h:

(WTF::HashMapTranslator::translate):
(WTF::HashMapEnsureTranslator::hash):
(WTF::HashMapEnsureTranslator::equal):
(WTF::HashMapEnsureTranslator::translate):
(WTF::HashMapTranslatorAdapter::hash):

Tools:

TestWebKitAPI/Tests/WTF/HashMap.cpp:

Add tests for HashMap::ensure.

12:42 PM Changeset in webkit [196715] by beidson@apple.com

10 edits in trunk/Source

Modern IDB: Encoder/Decoder/Messaging scaffolding for WK2 IPC.
https://bugs.webkit.org/show_bug.cgi?id=154351

Reviewed by Alex Christensen.

No change in behavior yet; Just laying the groundwork.

Source/WebCore:

Modules/indexeddb/IDBDatabaseIdentifier.h:

(WebCore::IDBDatabaseIdentifier::encode):
(WebCore::IDBDatabaseIdentifier::decode):

Modules/indexeddb/shared/IDBCursorInfo.h:

(WebCore::IDBCursorInfo::encode):
(WebCore::IDBCursorInfo::decode):

Modules/indexeddb/shared/IDBIndexInfo.h:

(WebCore::IDBIndexInfo::encode):
(WebCore::IDBIndexInfo::decode):

Modules/indexeddb/shared/IDBObjectStoreInfo.h:

(WebCore::IDBObjectStoreInfo::encode):
(WebCore::IDBObjectStoreInfo::decode):

Modules/indexeddb/shared/IDBRequestData.h:

(WebCore::IDBRequestData::encode):
(WebCore::IDBRequestData::decode):

Modules/indexeddb/shared/IDBResourceIdentifier.h:

(WebCore::IDBResourceIdentifier::encode):
(WebCore::IDBResourceIdentifier::decode):

Modules/indexeddb/shared/IDBTransactionInfo.h:

(WebCore::IDBTransactionInfo::encode):
(WebCore::IDBTransactionInfo::decode):

Source/WebKit2:

Implement in all of the client->server message sends, requiring many Encoder/Decoders for
IDB objects to also be implemented:

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::deleteDatabase):
(WebKit::WebIDBConnectionToServer::openDatabase):
(WebKit::WebIDBConnectionToServer::abortTransaction):
(WebKit::WebIDBConnectionToServer::commitTransaction):
(WebKit::WebIDBConnectionToServer::didFinishHandlingVersionChangeTransaction):
(WebKit::WebIDBConnectionToServer::createObjectStore):
(WebKit::WebIDBConnectionToServer::deleteObjectStore):
(WebKit::WebIDBConnectionToServer::clearObjectStore):
(WebKit::WebIDBConnectionToServer::createIndex):
(WebKit::WebIDBConnectionToServer::deleteIndex):
(WebKit::WebIDBConnectionToServer::putOrAdd):
(WebKit::WebIDBConnectionToServer::getRecord):
(WebKit::WebIDBConnectionToServer::getCount):
(WebKit::WebIDBConnectionToServer::deleteRecord):
(WebKit::WebIDBConnectionToServer::openCursor):
(WebKit::WebIDBConnectionToServer::iterateCursor):
(WebKit::WebIDBConnectionToServer::establishTransaction):
(WebKit::WebIDBConnectionToServer::databaseConnectionClosed):
(WebKit::WebIDBConnectionToServer::abortOpenAndUpgradeNeeded):
(WebKit::WebIDBConnectionToServer::didFireVersionChangeEvent):

12:40 PM Changeset in webkit [196714] by ddkilzer@apple.com

2 edits in trunk/Source/WebKit/ios

[iOS WK1] NSTimer in WebGeolocationProviderIOS.mm fires on the main thread without the WebThreadLock
<http://webkit.org/b/154347>
<rdar://problem/19360382>

Reviewed by Andy Estes.

This isn't testable because the GeolocationClientMock in WebCore
bypasses this code in WebKit1.

Misc/WebGeolocationProviderIOS.mm:

(-[WebGeolocationProviderIOS _handlePendingInitialPosition:]):
Assert that this is always called on the WebThread.
(-[WebGeolocationProviderIOS registerWebView:]): Register the
NSTimer on the WebThread NSRunLoop.

12:29 PM Changeset in webkit [196713] by Matt Baker

23 edits in trunk/Source/WebInspectorUI

Web Inspector: add CSS variables for common border/background colors
https://bugs.webkit.org/show_bug.cgi?id=154302
<rdar://problem/24680944>

Reviewed by Timothy Hatcher.

Added CSS variables for commonly used border and background colors, and removed
duplicate CSS variables with less generic names. Inactive border colors declared in
rules with a body.window-inactive selector have been removed. A new rule using this
selector in Variables.css sets "--border-color" to the inactive color.

UserInterface/Views/CSSStyleDetailsSidebarPanel.css:

(.sidebar > .panel.details.css-style > .content > .pseudo-classes):
(.sidebar > .panel.details.css-style > .content ~ :matches(.options-container, .class-list-container)):
(.sidebar > .panel.details.css-style > .content.filter-in-progress .style-declaration-section:not(.filter-section-has-label)):

UserInterface/Views/DataGrid.css:

(.data-grid.inline):
(.data-grid th):
(.data-grid :matches(th, td):not(:last-child)):
(body.window-inactive .data-grid th): Deleted.
(body.window-inactive .data-grid :matches(th, td):not(:last-child)): Deleted.

UserInterface/Views/DebuggerSidebarPanel.css:

(.sidebar > .panel.navigation.debugger.paused .details-section.scripts):

UserInterface/Views/DetailsSection.css:

(.details-section):
(.details-section .details-section:first-child):
(.details-section > .header):
(.details-section > .content > .group):
(.details-section > .content > .group:nth-child(even) > .row:matches(.simple:first-child > *, :not(.simple):first-child)):

UserInterface/Views/FilterBar.css:

(.filter-bar):

UserInterface/Views/FindBanner.css:

(.find-banner):
(body.window-inactive .find-banner): Deleted.

UserInterface/Views/LayerTreeDetailsSidebarPanel.css:

(.panel.details.layer-tree .bottom-bar):

UserInterface/Views/Main.css:

(body.docked.bottom):
(body.docked.right):
(#split-content-browser):
(#split-content-browser > .navigation-bar):
(body.window-inactive.docked.bottom): Deleted.
(body.window-inactive.docked.right): Deleted.
(body.window-inactive #split-content-browser): Deleted.

UserInterface/Views/MemoryCategoryView.css:

(.memory-category-view):
(.memory-category-view > .details):
(body.window-inactive .memory-category-view): Deleted.
(body.window-inactive .memory-category-view > .details): Deleted.

UserInterface/Views/MemoryTimelineView.css:

(.timeline-view.memory):
(.timeline-view.memory > .content > .overview):
(.timeline-view.memory > .content > .details > .subtitle):
(.timeline-view.memory > .content > .overview > .divider):
(body.window-inactive .timeline-view.memory): Deleted.
(body.window-inactive .timeline-view.memory > .content > .overview): Deleted.
(body.window-inactive .timeline-view.memory > .content > .details > .subtitle): Deleted.
(body.window-inactive .timeline-view.memory > .content > .overview > .divider): Deleted.

UserInterface/Views/NavigationBar.css:

(.navigation-bar):
(body.window-inactive .navigation-bar): Deleted.

UserInterface/Views/NavigationSidebarPanel.css:

(.sidebar > .panel.navigation > .overflow-shadow):
(body.window-inactive .sidebar > .panel.navigation > .overflow-shadow): Deleted.

UserInterface/Views/NetworkSidebarPanel.css:

(.sidebar > .panel.navigation.network > .title-bar):
(body.window-inactive .sidebar > .panel.navigation.network > .title-bar): Deleted.

UserInterface/Views/OverviewTimelineView.css:

(.timeline-view.overview > .timeline-ruler > .header):
(body.window-inactive .timeline-view.overview > .timeline-ruler > .header): Deleted.

UserInterface/Views/QuickConsole.css:

(.quick-console):
(body.window-inactive .quick-console): Deleted.

UserInterface/Views/Sidebar.css:

(.sidebar):
(.sidebar.left):
(.sidebar.right):
(body.window-inactive .sidebar.left): Deleted.
(body.window-inactive .sidebar.right): Deleted.

UserInterface/Views/TimelineDataGrid.css:

(.data-grid.timeline th):
(body.window-inactive .data-grid.timeline th): Deleted.

UserInterface/Views/TimelineRuler.css:

(.timeline-ruler > .header):
(body.window-inactive .timeline-ruler > .header): Deleted.

UserInterface/Views/TimelineSidebarPanel.css:

(.sidebar > .panel.navigation.timeline > .title-bar):
(.sidebar > .panel.navigation.timeline > .title-bar.timeline-events):
(body.window-inactive .sidebar > .panel.navigation.timeline > .title-bar): Deleted.
(body.window-inactive .sidebar > .panel.navigation.timeline > .title-bar.timeline-events): Deleted.

UserInterface/Views/Toolbar.css:

(body.latest-mac .toolbar .dashboard-container):

UserInterface/Views/Variables.css:

(:root):
(body.window-inactive *):

UserInterface/Views/VisualStyleSelectorSection.css:

(.details-section.visual-style-selector-section:not(.collapsed) > .header):
(.details-section.visual-style-selector-section > .content > .selectors > .selector-list > .section-divider):

12:27 PM Changeset in webkit [196712] by akling@apple.com

3 edits in trunk/Source/WebCore

[iOS] Purge GraphicsServices font cache on memory warning.
<https://webkit.org/b/154343>

Reviewed by Antti Koivisto.

The GS font cache was holding on to the last retain on CSS fonts after they stop being used.
Call SPI to purge it on memory pressure.

platform/cocoa/MemoryPressureHandlerCocoa.mm:

(WebCore::MemoryPressureHandler::platformReleaseMemory):

platform/spi/ios/GraphicsServicesSPI.h:

12:22 PM Changeset in webkit [196711] by beidson@apple.com

2 edits in trunk/Source

Revert accidentally committed ChangeLogs

12:19 PM Changeset in webkit [196710] by Chris Dumez

3 edits
18 adds in trunk/LayoutTests

Import W3C HTML reflection tests
https://bugs.webkit.org/show_bug.cgi?id=154310
<rdar://problem/24685826>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Import W3C HTML reflection tests from:
https://github.com/w3c/web-platform-tests/tree/master/html/dom

This improves our test coverage.

web-platform-tests/html/dom/reflection-embedded-expected.txt: Added.
web-platform-tests/html/dom/reflection-embedded.html: Added.
web-platform-tests/html/dom/reflection-forms-expected.txt: Added.
web-platform-tests/html/dom/reflection-forms.html: Added.
web-platform-tests/html/dom/reflection-grouping-expected.txt: Added.
web-platform-tests/html/dom/reflection-grouping.html: Added.
web-platform-tests/html/dom/reflection-metadata-expected.txt: Added.
web-platform-tests/html/dom/reflection-metadata.html: Added.
web-platform-tests/html/dom/reflection-misc-expected.txt: Added.
web-platform-tests/html/dom/reflection-misc.html: Added.
web-platform-tests/html/dom/reflection-obsolete-expected.txt: Added.
web-platform-tests/html/dom/reflection-obsolete.html: Added.
web-platform-tests/html/dom/reflection-sections-expected.txt: Added.
web-platform-tests/html/dom/reflection-sections.html: Added.
web-platform-tests/html/dom/reflection-tabular-expected.txt: Added.
web-platform-tests/html/dom/reflection-tabular.html: Added.
web-platform-tests/html/dom/reflection-text-expected.txt: Added.
web-platform-tests/html/dom/reflection-text.html: Added.

LayoutTests:

Skip newly imported tests in Debug builds because they are slow.

TestExpectations:

12:19 PM Changeset in webkit [196709] by beidson@apple.com

2 edits in trunk/Source

Modern IDB: More WK2 IPC Scaffolding.
https://bugs.webkit.org/show_bug.cgi?id=154317

Reviewed by Alex Christensen.

No change in behavior yet; Just laying the groundwork.

Source/WebCore:

Modules/indexeddb/shared/IDBCursorInfo.cpp:

(WebCore::IDBCursorInfo::IDBCursorInfo):

Modules/indexeddb/shared/IDBCursorInfo.h:

(WebCore::IDBCursorInfo::decode):

Modules/indexeddb/shared/IDBError.h:

(WebCore::IDBError::decode):

Modules/indexeddb/shared/IDBIndexInfo.h:

(WebCore::IDBIndexInfo::decode):

Modules/indexeddb/shared/IDBObjectStoreInfo.h:

(WebCore::IDBObjectStoreInfo::decode):

Modules/indexeddb/shared/IDBRequestData.cpp:

(WebCore::IDBRequestData::IDBRequestData):

Modules/indexeddb/shared/IDBRequestData.h:

(WebCore::IDBRequestData::decode):

Modules/indexeddb/shared/IDBResourceIdentifier.cpp:

(WebCore::IDBResourceIdentifier::IDBResourceIdentifier):

Modules/indexeddb/shared/IDBResourceIdentifier.h:

(WebCore::IDBResourceIdentifier::decode):

Modules/indexeddb/shared/IDBResultData.cpp:

(WebCore::IDBResultData::IDBResultData):

Modules/indexeddb/shared/IDBResultData.h:

(WebCore::IDBResultData::decode):

Modules/indexeddb/shared/IDBTransactionInfo.cpp:

(WebCore::IDBTransactionInfo::IDBTransactionInfo):

Modules/indexeddb/shared/IDBTransactionInfo.h:

(WebCore::IDBTransactionInfo::decode):

WebCore.xcodeproj/project.pbxproj:

Source/WebKit2:

CMakeLists.txt:
DerivedSources.make:
WebKit2.xcodeproj/project.pbxproj:

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.cpp:

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h:
DatabaseProcess/IndexedDB/WebIDBConnectionToClient.messages.in: Added.

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.h:
WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.messages.in: Added.

12:18 PM Changeset in webkit [196708] by rniwa@webkit.org

4 edits
1 add in trunk/Websites/perf.webkit.org

v3 UI has the capability to schedule an A/B testing in a specific range
https://bugs.webkit.org/show_bug.cgi?id=154329

Reviewed by Chris Dumez.

Extended AnalysisTaskChartPane and ResultsTable so that users can select a range of points in either
the overview chart pane and the results viewer table. Extracted TestGroupForm out of the analysis task
page and used right below those two components in the analysis task page.

public/v3/components/results-table.js:

(ResultsTable):
(ResultsTable.prototype.setRangeSelectorLabels): Added.
(ResultsTable.prototype.setRangeSelectorCallback): Added.
(ResultsTable.prototype.selectedRange): Added.
(ResultsTable.prototype._rangeSelectorClicked): Added.
(ResultsTable.prototype.render): Generate radio boxes to select a range.

public/v3/components/test-group-form.js:

(TestGroupForm):
(TestGroupForm.prototype.setStartCallback): Added.
(TestGroupForm.prototype.setNeedsName): Added.
(TestGroupForm.prototype.setDisabled): Added.
(TestGroupForm.prototype.setLabel): Added.
(TestGroupForm.prototype.setRepetitionCount): Added.
(TestGroupForm.prototype._submitted): Added.
(TestGroupForm.htmlTemplate): Extracted from AnalysisTaskPage.htmlTemplate.

public/v3/index.html:

public/v3/pages/analysis-task-page.js:

(AnalysisTaskChartPane.prototype._mainSelectionDidChange): Added. Delegates the work to AnalysisTaskPage.
(AnalysisTaskChartPane.prototype.selectedPoints): Added.
(AnalysisTaskPage):
(AnalysisTaskPage.prototype.title):
(AnalysisTaskPage.prototype.render):
(AnalysisTaskPage.prototype._renderTestGroupDetails): Use TestGroupForm's methods instead of mutating DOM.
(AnalysisTaskPage.prototype._retryCurrentTestGroup):
(AnalysisTaskPage.prototype._chartSelectionDidChange): Added.
(AnalysisTaskPage.prototype._createNewTestGroupFromChart): Added.
(AnalysisTaskPage.prototype._selectedRowInAnalysisResultsViewer): Added.
(AnalysisTaskPage.prototype._createNewTestGroupFromViewer): Added.
(AnalysisTaskPage.prototype._createRetryNameForTestGroup):
(AnalysisTaskPage.prototype._createTestGroupAfterVerifyingRootSetList): Extracted from _retryCurrentTestGroup
so that we can call it in _createNewTestGroupFromChart and _createNewTestGroupFromViewer.
(AnalysisTaskPage.htmlTemplate):

12:11 PM Changeset in webkit [196707] by achristensen@apple.com

4 edits
2 copies in trunk

Copy http body when being redirected with 308 with NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154348

Reviewed by Brady Eidson.
Source/WebKit2:

This fixes http/tests/security/cors-post-redirect-308.html
which used to assert in ResourceRequest::doUpdateResourceHTTPBody

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::willPerformHTTPRedirection):

LayoutTests:

http/tests/navigation/post-308-response-expected.txt: Copied from LayoutTests/http/tests/navigation/post-307-response-expected.txt.
http/tests/navigation/post-308-response.html: Copied from LayoutTests/http/tests/navigation/post-307-response.html.
http/tests/navigation/resources/redirection-response.php:

Added a test verifying data is being sent with post requests after being redirected with an http status code of 308.
We already had non-CORS tests for 301, 302, 303, and 307, and we already had CORS tests for 301, 302, 303, 307, and 308.
This fills in the missing non-CORS test.

11:31 AM Changeset in webkit [196706] by Chris Dumez

8 edits
2 adds in trunk

Regression(r196648): window.showModalDialog is no longer undefined if the client does not allow showing modal dialog
https://bugs.webkit.org/show_bug.cgi?id=154330

Reviewed by Gavin Barraclough.

Source/WebCore:

window.showModalDialog is no longer undefined if the client does not
allow showing modal dialog after r196648. This patch fixes the issue
and add test coverage for this.

Test: fast/dom/Window/forbid-showModalDialog.html

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::getOwnPropertySlot):

Move the DOMWindow::canShowModalDialog() check *before* checking for static properties as showModalDialog is now in the static property table after r196648.
Add check for Base::getOwnPropertySlot() first to support overriding window.showModalDialog (This behavior matches Firefox).
Return false if DOMWindow::canShowModalDialog() returns false as this seems cleaner than claiming that the property is there but undefined.

page/DOMWindow.cpp:

(WebCore::DOMWindow::canShowModalDialogNow): Deleted.
This was indentical to canShowModalDialog().

(WebCore::DOMWindow::canShowModalDialog):
(WebCore::DOMWindow::setCanShowModalDialogOverride):
(WebCore::DOMWindow::showModalDialog):

page/DOMWindow.h:
testing/Internals.cpp:

(WebCore::Internals::setCanShowModalDialogOverride):

testing/Internals.h:
testing/Internals.idl:

Add support for overriding the ChromeClient's canShowModalDialog
decision and hook it up to Internals to add layout test coverage.

LayoutTests:

Add layout test to make sure that window.showModalDialog is undefined
when the client does not allow showing modal dialog and to check that
window.showModalDialog can be shadowed.

fast/dom/Window/forbid-showModalDialog-expected.txt: Added.
fast/dom/Window/forbid-showModalDialog.html: Added.

11:21 AM Changeset in webkit [196705] by beidson@apple.com

23 edits
2 adds in trunk/Source

Modern IDB: More WK2 IPC Scaffolding.
https://bugs.webkit.org/show_bug.cgi?id=154317

Reviewed by Alex Christensen.

No change in behavior yet; Just laying the groundwork.

Source/WebCore:

Modules/indexeddb/shared/IDBCursorInfo.cpp:

(WebCore::IDBCursorInfo::IDBCursorInfo):

Modules/indexeddb/shared/IDBCursorInfo.h:

(WebCore::IDBCursorInfo::decode):

Modules/indexeddb/shared/IDBError.h:

(WebCore::IDBError::decode):

Modules/indexeddb/shared/IDBIndexInfo.h:

(WebCore::IDBIndexInfo::decode):

Modules/indexeddb/shared/IDBObjectStoreInfo.h:

(WebCore::IDBObjectStoreInfo::decode):

Modules/indexeddb/shared/IDBRequestData.cpp:

(WebCore::IDBRequestData::IDBRequestData):

Modules/indexeddb/shared/IDBRequestData.h:

(WebCore::IDBRequestData::decode):

Modules/indexeddb/shared/IDBResourceIdentifier.cpp:

(WebCore::IDBResourceIdentifier::IDBResourceIdentifier):

Modules/indexeddb/shared/IDBResourceIdentifier.h:

(WebCore::IDBResourceIdentifier::decode):

Modules/indexeddb/shared/IDBResultData.cpp:

(WebCore::IDBResultData::IDBResultData):

Modules/indexeddb/shared/IDBResultData.h:

(WebCore::IDBResultData::decode):

Modules/indexeddb/shared/IDBTransactionInfo.cpp:

(WebCore::IDBTransactionInfo::IDBTransactionInfo):

Modules/indexeddb/shared/IDBTransactionInfo.h:

(WebCore::IDBTransactionInfo::decode):

WebCore.xcodeproj/project.pbxproj:

Source/WebKit2:

CMakeLists.txt:
DerivedSources.make:
WebKit2.xcodeproj/project.pbxproj:

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.cpp:

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h:
DatabaseProcess/IndexedDB/WebIDBConnectionToClient.messages.in: Added.

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.h:
WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.messages.in: Added.

11:18 AM Changeset in webkit [196704] by commit-queue@webkit.org

12 edits
1 delete in trunk

Unreviewed, rolling out r196675.
https://bugs.webkit.org/show_bug.cgi?id=154344

"Causes major slowdowns on deltablue-varargs" (Requested by

keith_miller on #webkit).

Reverted changeset:

"Spread operator should be allowed when not the first argument
of parameter list"
https://bugs.webkit.org/show_bug.cgi?id=152721
http://trac.webkit.org/changeset/196675

11:17 AM Changeset in webkit [196703] by eric.carlson@apple.com

2 edits in trunk/Source/WebCore

[Win] Allow ports to disable automatic text track selection
https://bugs.webkit.org/show_bug.cgi?id=154322
<rdar://problem/24623986>

Reviewed by Brent Fulgham.

page/CaptionUserPreferencesMediaAF.cpp:

(MTEnableCaption2015BehaviorPtr): Implement for Windows.

11:04 AM Changeset in webkit [196702] by barraclough@apple.com

4 edits in trunk/Source

JSDOMWindow::put should not do the same thing twice
https://bugs.webkit.org/show_bug.cgi?id=154334

Reviewed by Chris Dumez.

It either calls JSGlobalObject::put or Base::put. Hint: these are basically the same thing.
In the latter case it might call lookupPut. That's redundant; JSObject::put handles static
table entries.

Source/JavaScriptCore:

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::hasOwnPropertyForWrite): Deleted.

no longer needed.

Source/WebCore:

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::put):

just call Base::put.

(WebCore::JSDOMWindow::putByIndex):

just call Base::putByIndex.

11:03 AM Changeset in webkit [196701] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

CMake build fix after r196698.

PlatformMac.cmake:

10:50 AM Changeset in webkit [196700] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

CMake build fix after r196698.

CMakeLists.txt:

10:16 AM Changeset in webkit [196699] by n_wang@apple.com

19 edits
2 adds in trunk

AX: Implement sentence related text marker functions using TextIterator
https://bugs.webkit.org/show_bug.cgi?id=154312

Reviewed by Chris Fleizach.

Source/WebCore:

Using CharacterOffset to implement sentence related text marker calls. Reused
logic from VisibleUnits class. Also fixed an issue where paragraph navigation
should skip preceding and following BR nodes.

Test: accessibility/mac/text-marker-sentence-nav.html

accessibility/AXObjectCache.cpp:

(WebCore::resetNodeAndOffsetForReplacedNode):
(WebCore::setRangeStartOrEndWithCharacterOffset):
(WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
(WebCore::AXObjectCache::previousCharacterOffset):
(WebCore::AXObjectCache::startCharacterOffsetOfWord):
(WebCore::AXObjectCache::endCharacterOffsetOfWord):
(WebCore::AXObjectCache::previousWordStartCharacterOffset):
(WebCore::AXObjectCache::leftWordRange):
(WebCore::AXObjectCache::rightWordRange):
(WebCore::AXObjectCache::characterBefore):
(WebCore::characterOffsetNodeIsBR):
(WebCore::parentEditingBoundary):
(WebCore::AXObjectCache::nextBoundary):
(WebCore::AXObjectCache::previousBoundary):
(WebCore::AXObjectCache::paragraphForCharacterOffset):
(WebCore::AXObjectCache::nextParagraphEndCharacterOffset):
(WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
(WebCore::AXObjectCache::startCharacterOffsetOfSentence):
(WebCore::AXObjectCache::endCharacterOffsetOfSentence):
(WebCore::AXObjectCache::sentenceForCharacterOffset):
(WebCore::AXObjectCache::nextSentenceEndCharacterOffset):
(WebCore::AXObjectCache::previousSentenceStartCharacterOffset):
(WebCore::AXObjectCache::rootAXEditableElement):
(WebCore::startWordBoundary): Deleted.
(WebCore::endWordBoundary): Deleted.
(WebCore::AXObjectCache::nextWordBoundary): Deleted.
(WebCore::AXObjectCache::previousWordBoundary): Deleted.

accessibility/AXObjectCache.h:
accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

editing/VisibleUnits.cpp:

(WebCore::startWordBoundary):
(WebCore::startOfWord):
(WebCore::endWordBoundary):
(WebCore::startSentenceBoundary):
(WebCore::startOfSentence):
(WebCore::endSentenceBoundary):

editing/VisibleUnits.h:

Tools:

DumpRenderTree/AccessibilityUIElement.cpp:

(nextParagraphEndTextMarkerForTextMarkerCallback):
(sentenceTextMarkerRangeForTextMarkerCallback):
(previousSentenceStartTextMarkerForTextMarkerCallback):
(nextSentenceEndTextMarkerForTextMarkerCallback):
(setSelectedVisibleTextRangeCallback):
(AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):
(AccessibilityUIElement::sentenceTextMarkerRangeForTextMarker):
(AccessibilityUIElement::previousSentenceStartTextMarkerForTextMarker):
(AccessibilityUIElement::nextSentenceEndTextMarkerForTextMarker):
(AccessibilityUIElement::getJSClass):

DumpRenderTree/AccessibilityUIElement.h:
DumpRenderTree/ios/AccessibilityUIElementIOS.mm:

(AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):
(AccessibilityUIElement::sentenceTextMarkerRangeForTextMarker):
(AccessibilityUIElement::previousSentenceStartTextMarkerForTextMarker):
(AccessibilityUIElement::nextSentenceEndTextMarkerForTextMarker):

DumpRenderTree/mac/AccessibilityUIElementMac.mm:

WebKitTestRunner/InjectedBundle/AccessibilityUIElement.cpp:

(WTR::AccessibilityUIElement::paragraphTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::previousParagraphStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::sentenceTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::nextSentenceEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::previousSentenceStartTextMarkerForTextMarker):

WebKitTestRunner/InjectedBundle/AccessibilityUIElement.h:
WebKitTestRunner/InjectedBundle/Bindings/AccessibilityUIElement.idl:
WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:

(WTR::AccessibilityUIElement::previousParagraphStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::sentenceTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::nextSentenceEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::previousSentenceStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::mathPostscriptsDescription):

WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:

(WTR::AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::sentenceTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::previousSentenceStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::nextSentenceEndTextMarkerForTextMarker):
(WTR::_convertMathMultiscriptPairsToString):

LayoutTests:

accessibility/mac/text-marker-paragraph-nav-expected.txt:
accessibility/mac/text-marker-paragraph-nav.html:
accessibility/mac/text-marker-sentence-nav-expected.txt: Added.
accessibility/mac/text-marker-sentence-nav.html: Added.

10:15 AM Changeset in webkit [196698] by andersca@apple.com

9 edits
8 deletes in trunk/Source/WebKit2

Remove unused media cache manager code
https://bugs.webkit.org/show_bug.cgi?id=154339

Reviewed by Tim Horton.

DerivedSources.make:
Shared/API/c/WKBase.h:
UIProcess/API/C/WKAPICast.h:
UIProcess/API/C/WKContext.cpp:

(WKContextGetMediaCacheManager): Deleted.

UIProcess/API/C/WKContext.h:
UIProcess/API/C/WKMediaCacheManager.cpp: Removed.

(WKMediaCacheManagerGetTypeID): Deleted.
(WKMediaCacheManagerGetHostnamesWithMediaCache): Deleted.
(WKMediaCacheManagerClearCacheForHostname): Deleted.
(WKMediaCacheManagerClearCacheForAllHostnames): Deleted.

UIProcess/API/C/WKMediaCacheManager.h: Removed.
UIProcess/WebMediaCacheManagerProxy.cpp: Removed.

(WebKit::WebMediaCacheManagerProxy::supplementName): Deleted.
(WebKit::WebMediaCacheManagerProxy::create): Deleted.
(WebKit::WebMediaCacheManagerProxy::WebMediaCacheManagerProxy): Deleted.
(WebKit::WebMediaCacheManagerProxy::~WebMediaCacheManagerProxy): Deleted.
(WebKit::WebMediaCacheManagerProxy::processPoolDestroyed): Deleted.
(WebKit::WebMediaCacheManagerProxy::processDidClose): Deleted.
(WebKit::WebMediaCacheManagerProxy::shouldTerminate): Deleted.
(WebKit::WebMediaCacheManagerProxy::refWebContextSupplement): Deleted.
(WebKit::WebMediaCacheManagerProxy::derefWebContextSupplement): Deleted.
(WebKit::WebMediaCacheManagerProxy::getHostnamesWithMediaCache): Deleted.
(WebKit::WebMediaCacheManagerProxy::didGetHostnamesWithMediaCache): Deleted.
(WebKit::WebMediaCacheManagerProxy::clearCacheForHostname): Deleted.
(WebKit::WebMediaCacheManagerProxy::clearCacheForAllHostnames): Deleted.

UIProcess/WebMediaCacheManagerProxy.h: Removed.
UIProcess/WebMediaCacheManagerProxy.messages.in: Removed.
UIProcess/WebProcessPool.cpp:
WebKit2.xcodeproj/project.pbxproj:
WebProcess/MediaCache/WebMediaCacheManager.cpp: Removed.

(WebKit::WebMediaCacheManager::supplementName): Deleted.
(WebKit::WebMediaCacheManager::WebMediaCacheManager): Deleted.
(WebKit::WebMediaCacheManager::getHostnamesWithMediaCache): Deleted.
(WebKit::WebMediaCacheManager::clearCacheForHostname): Deleted.
(WebKit::WebMediaCacheManager::clearCacheForAllHostnames): Deleted.

WebProcess/MediaCache/WebMediaCacheManager.h: Removed.
WebProcess/MediaCache/WebMediaCacheManager.messages.in: Removed.
WebProcess/WebProcess.cpp:

(WebKit::m_webSQLiteDatabaseTracker): Deleted.

9:46 AM Changeset in webkit [196697] by Ryan Haddad

1 edit
2 adds in trunk/LayoutTests

Adding an ios-specific baseline for accessibility/ios-simulator/centerpoint.html during failure investigation
https://bugs.webkit.org/show_bug.cgi?id=154137

Unreviewed test gardening.

platform/ios-simulator/accessibility/ios-simulator/centerpoint-expected.txt: Added.

9:32 AM Changeset in webkit [196696] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

9:25 AM Changeset in webkit [196695] by Ryan Haddad

2 edits in trunk/LayoutTests

Skipping tests added with r196688 on ios-simulator due to reliance on unsupported mouse events.

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

9:22 AM WebKitIDL edited by Chris Dumez

Drop [EventTarget] (diff)

8:50 AM Changeset in webkit [196694] by bshafiei@apple.com

5 edits in trunk/Source

Versioning.

8:48 AM Changeset in webkit [196693] by bshafiei@apple.com

1 copy in tags/Safari-602.1.19

New tag.

8:01 AM Changeset in webkit [196692] by Matt Baker

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Add singular and plural cases for "Ignore n times before stopping" label in breakpoint editor
https://bugs.webkit.org/show_bug.cgi?id=154335
<rdar://problem/24655491>

Reviewed by Timothy Hatcher.

Localizations/en.lproj/localizedStrings.js:

Added string for singular ignore count.

UserInterface/Controllers/BreakpointPopoverController.js:

(WebInspector.BreakpointPopoverController.prototype._createPopoverContent):
Remove unused variable "this._ignoreCount" and update ignore count text.

(WebInspector.BreakpointPopoverController.prototype._popoverIgnoreInputChanged):
Update ignore count text as value changes.

(WebInspector.BreakpointPopoverController.prototype._updateIgnoreCountText):
Set singular text when count === 1, otherwise set plural text.

3:45 AM Changeset in webkit [196691] by Manuel Rego Casasnovas

8 edits in trunk/Source/WebCore

[css-grid] GridSpan refactoring
https://bugs.webkit.org/show_bug.cgi?id=153868

Reviewed by Sergio Villar Senin.

Add new enum to know if a GridSpan is definite or indefinite.
That way we don't need GridUnresolvedSpan class (which is removed).
We can always have two GridSpans in GridCoordinate,
if the position is "auto" the GridSpan will be marked as indefinite.
This will allow in a follow-up patch to avoid repeated calls
to methods that resolve positions.

Most operations in GridSpan are restricted to definite GridSpans (access
to positions, iterator, etc.). For indefinite GridSpans we only need to
know that they're indefinite, we shouldn't use the rest of the data.

No new tests, no change of behavior.

css/CSSGridTemplateAreasValue.cpp:

(WebCore::stringForPosition):

css/CSSParser.cpp:

(WebCore::CSSParser::parseGridTemplateAreasRow):

css/StyleBuilderConverter.h:

(WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
(WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
(WebCore::RenderGrid::insertItemIntoGrid):
(WebCore::RenderGrid::placeItemsOnGrid):
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
(WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
(WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
(WebCore::RenderGrid::columnAxisOffsetForChild):
(WebCore::RenderGrid::rowAxisOffsetForChild):
(WebCore::RenderGrid::placeAutoMajorAxisItemsOnGrid): Deleted.
(WebCore::RenderGrid::autoPlacementMinorAxisDirection): Deleted.
(WebCore::RenderGrid::populateGridPositions): Deleted.

rendering/style/GridCoordinate.h:

(WebCore::GridSpan::definiteGridSpan):
(WebCore::GridSpan::indefiniteGridSpan):
(WebCore::GridSpan::operator==):
(WebCore::GridSpan::integerSpan):
(WebCore::GridSpan::resolvedInitialPosition):
(WebCore::GridSpan::resolvedFinalPosition):
(WebCore::GridSpan::begin):
(WebCore::GridSpan::end):
(WebCore::GridSpan::isDefinite):
(WebCore::GridSpan::GridSpan):
(WebCore::GridCoordinate::GridCoordinate):

rendering/style/GridResolvedPosition.cpp:

(WebCore::initialPositionSide):
(WebCore::finalPositionSide):
(WebCore::adjustGridPositionsFromStyle):
(WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveGridPositionAgainstOppositePosition):
(WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
(WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
(WebCore::implicitNamedGridLineForSide): Deleted.
(WebCore::GridResolvedPosition::isNonExistentNamedLineOrArea): Deleted.
(WebCore::resolveNamedGridLinePositionFromStyle): Deleted.
(WebCore::resolveGridPositionFromStyle): Deleted.

rendering/style/GridResolvedPosition.h:

12:38 AM Changeset in webkit [196690] by Chris Dumez

10 edits in trunk

Window should have its 'constructor' property on the prototype
https://bugs.webkit.org/show_bug.cgi?id=154037
<rdar://problem/24689078>

Reviewed by Gavin Barraclough.

LayoutTests/imported/w3c:

Rebaseline W3C test now that one more check is passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Window should have its 'constructor' property on the prototype as per
the Web IDL specification:
http://heycam.github.io/webidl/#interface-prototype-object

Firefox and Chrome already match the specification.

No new tests, covered by:

fast/dom/Window/window-constructor-settable.html
fast/dom/Window/window-constructor.html
http/tests/security/cross-origin-window-property-access.html
imported/w3c/web-platform-tests/html/dom/interfaces.html

bindings/scripts/CodeGeneratorJS.pm:

(ConstructorShouldBeOnInstance): Deleted.
Drop this routine as all constructors are now on the prototype.

(InstancePropertyCount):
Do not account for constructor properties as these can only be
on the prototype now.

(PrototypePropertyCount):
Increment the property count by 1 if the interface has a constructor
property (e.g. [NoInterfaceObject] interfaces do not have one).

(GeneratePropertiesHashTable):
Stop calling ConstructorShouldBeOnInstance() as it no longer exists.
Always generated the "constructor" property if:

We are generating the prototype hash table.

and

The interface needs a constructor (i.e. not marked as [NoInterfaceObject]).

(GenerateImplementation):

Drop code handling the case where ConstructorShouldBeOnInstance() returns true as constructors are not always on the prototype and the ConstructorShouldBeOnInstance() routine has been dropped.
Drop code handling [CustomProxyToJSObject]. Now that the constructor is always on the prototype, we never need to cast thisValue to a JSDOMWindow (by calling toJSDOMWindow). In the Window case, thisValue is now casted to a JSDOMWindowPrototype*, similarly to other interfaces so we don't need a special casting function anymore.
Stop generating security checks. This only impacts Window as it is the only interface marked as [CheckSecurity]. The cross-origin checking code as it was would not work when "constructor" is on the prototype because thisValue is a JSDOMWindowPrototype, not a JSDOMWindow and we have no way of getting the wrapped window. Also, the security check is no longer needed because:
1. Accessing crossOriginWindow.constructor will not work now that constructor is on the prototype because JSDOMWindow::getOwnPropertySlot() already prevents access to the prototype in the cross-origin case.
2. "constructor" is a value property, not a getter/setter. Therefore, it is no possible to use the getter/setter from a same origin window instance and call it on a cross origin window.

LayoutTests:

http/tests/security/cross-origin-window-property-access-expected.txt:
http/tests/security/cross-origin-window-property-access.html:

Add checks to make sure it still is not possible to access
window.constructor cross-origin.

js/getOwnPropertyDescriptor-window-attributes-expected.txt:
js/getOwnPropertyDescriptor-window-attributes.html:

Update test now that window has it's "constructor" attribute
on the prototype.

Feb 16, 2016:

11:40 PM WebKitGTK/2.10.x edited by Carlos Garcia Campos

(diff)

11:18 PM Changeset in webkit [196689] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

REGRESSION (r196620): Web Inspector: Selecting last message in the console makes the scrollbar visible
https://bugs.webkit.org/show_bug.cgi?id=154326
<rdar://problem/24692717>

Reviewed by Timothy Hatcher.

UserInterface/Views/LogContentView.css:

(.console-item.selected::after):
Make sure the selected message marker (blue vertical line) doesn't
go over the content view.

11:16 PM Changeset in webkit [196688] by Carlos Garcia Campos

22 edits
13 adds in trunk

Add a way to test ScrollAnimator
https://bugs.webkit.org/show_bug.cgi?id=153479

Reviewed by Michael Catanzaro.

Source/WebCore:

Tests: fast/scrolling/overlay-scrollbars-scroll-corner.html

fast/scrolling/scroll-animator-basic-events.html
fast/scrolling/scroll-animator-overlay-scrollbars-hovered.html
fast/scrolling/scroll-animator-select-list-events.html

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
page/FrameView.cpp:

(WebCore::FrameView::usesMockScrollAnimator):
(WebCore::FrameView::logMockScrollAnimatorMessage):

page/FrameView.h:
page/Settings.cpp:

(WebCore::Settings::setUsesMockScrollAnimator):
(WebCore::Settings::usesMockScrollAnimator):

page/Settings.h:
platform/ScrollableArea.cpp:

(WebCore::ScrollableArea::scrollAnimator):

platform/ScrollableArea.h:

(WebCore::ScrollableArea::usesMockScrollAnimator):
(WebCore::ScrollableArea::logMockScrollAnimatorMessage):

platform/mock/ScrollAnimatorMock.cpp: Added.

(WebCore::ScrollAnimatorMock::create):
(WebCore::ScrollAnimatorMock::ScrollAnimatorMock):
(WebCore::ScrollAnimatorMock::~ScrollAnimatorMock):
(WebCore::ScrollAnimatorMock::didAddVerticalScrollbar):
(WebCore::ScrollAnimatorMock::didAddHorizontalScrollbar):
(WebCore::ScrollAnimatorMock::willRemoveVerticalScrollbar):
(WebCore::ScrollAnimatorMock::willRemoveHorizontalScrollbar):
(WebCore::ScrollAnimatorMock::mouseEnteredContentArea):
(WebCore::ScrollAnimatorMock::mouseMovedInContentArea):
(WebCore::ScrollAnimatorMock::mouseExitedContentArea):
(WebCore::ScrollAnimatorMock::mouseEnteredScrollbar):
(WebCore::ScrollAnimatorMock::mouseExitedScrollbar):
(WebCore::ScrollAnimatorMock::mouseIsDownInScrollbar):

platform/mock/ScrollAnimatorMock.h: Added.
platform/mock/ScrollbarThemeMock.cpp:

(WebCore::ScrollbarThemeMock::usesOverlayScrollbars):

platform/mock/ScrollbarThemeMock.h:
rendering/RenderLayer.cpp:

(WebCore::RenderLayer::usesMockScrollAnimator):
(WebCore::RenderLayer::logMockScrollAnimatorMessage):

rendering/RenderLayer.h:
rendering/RenderListBox.cpp:

(WebCore::RenderListBox::usesMockScrollAnimator):
(WebCore::RenderListBox::logMockScrollAnimatorMessage):

rendering/RenderListBox.h:
testing/Internals.cpp:

(WebCore::Internals::resetToConsistentState):
(WebCore::Internals::setUsesMockScrollAnimator):

testing/Internals.h:
testing/Internals.idl:

LayoutTests:

compositing/overflow/overflow-scrollbar-layer-positions-expected.txt:
fast/scrolling/overlay-scrollbars-scroll-corner-expected.html: Added.
fast/scrolling/overlay-scrollbars-scroll-corner.html: Added.
fast/scrolling/scroll-animator-basic-events-expected.txt: Added.
fast/scrolling/scroll-animator-basic-events.html: Added.
fast/scrolling/scroll-animator-overlay-scrollbars-hovered-expected.txt: Added.
fast/scrolling/scroll-animator-overlay-scrollbars-hovered.html: Added.
fast/scrolling/scroll-animator-select-list-events-expected.txt: Added.
fast/scrolling/scroll-animator-select-list-events.html: Added.
fast/scrolling/scrollbar-tickmarks-hittest.html:
platform/mac-wk1/TestExpectations:
platform/mac-wk1/fast/scrolling/scroll-animator-basic-events-expected.txt: Added.
platform/mac-wk1/fast/scrolling/scroll-animator-select-list-events-expected.txt: Added.

10:54 PM Changeset in webkit [196687] by Carlos Garcia Campos

2 edits in trunk/Source/WebCore

Unreviewed. Enable overlay scrollbars in GTK+ after r196641.

This was blocked by bug #153404, but the commit that introduced
the regression was rolled out in r196641.

platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk):

10:13 PM Changeset in webkit [196686] by fpizlo@apple.com

6 edits in trunk/Source

FTL_USES_B3 should be unconditionally true
https://bugs.webkit.org/show_bug.cgi?id=154324

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

dfg/DFGCommon.h:

Source/WTF:

wtf/Platform.h:

9:29 PM Changeset in webkit [196685] by fpizlo@apple.com

3 edits
3 adds in trunk/Source/JavaScriptCore

FTL should support CompareEq(String:, String:)
https://bugs.webkit.org/show_bug.cgi?id=154269
rdar://problem/24499921

Reviewed by Benjamin Poulain.

Looks like a slight pdfjs slow-down, probably because we're having some recompilations. I
think we should land the increased coverage first and fix the issues after, especially since
the regression is so small and doesn't have a statistically significant effect on the overall
score.

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::DFG::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
(JSC::FTL::DFG::LowerDFGToLLVM::stringsEqual):

tests/stress/ftl-string-equality.js: Added.
tests/stress/ftl-string-ident-equality.js: Added.
tests/stress/ftl-string-strict-equality.js: Added.

8:25 PM Changeset in webkit [196684] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

FTL should support NewTypedArray
https://bugs.webkit.org/show_bug.cgi?id=154268

Reviewed by Saam Barati.

3% speed-up on pdfjs. This was already covered by many different tests.

Rolling this back in after fixing the butterfly argument.

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
(JSC::FTL::DFG::LowerDFGToLLVM::compileNewArrayWithSize):
(JSC::FTL::DFG::LowerDFGToLLVM::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToLLVM::compileAllocatePropertyStorage):
(JSC::FTL::DFG::LowerDFGToLLVM::allocateBasicStorageAndGetEnd):
(JSC::FTL::DFG::LowerDFGToLLVM::allocateBasicStorage):
(JSC::FTL::DFG::LowerDFGToLLVM::allocateObject):

8:11 PM Changeset in webkit [196683] by bshafiei@apple.com

1 copy in tags/Safari-601.1.46.101

New tag.

8:04 PM Changeset in webkit [196682] by bshafiei@apple.com

10 edits in tags/Safari-601.1.46.100.1

Merge patch for r192036 and r196679. rdar://problem/24355523

8:03 PM Changeset in webkit [196681] by bshafiei@apple.com

5 edits in tags/Safari-601.1.46.100.1/Source

Versioning.

7:58 PM Changeset in webkit [196680] by bshafiei@apple.com

10 edits in branches/safari-601.1.46-branch

Merge patch for r192036 and r196679. rdar://problem/24355523

7:27 PM Changeset in webkit [196679] by dino@apple.com

4 edits in trunk/Source/WebKit2

Allow double tap to zoom in fast-click pages
https://bugs.webkit.org/show_bug.cgi?id=154318
<rdar://problem/24223767>

Reviewed by Simon Fraser and Benjamin Poulain.

Most of the patch comes from Jon Lee.

Our fast-click algorithm exposed a number of cases where
people missed the double-tap-to-zoom behaviour. In particular,
when you double tap on a large body of text, typical in
blogs and articles.

This patch enhances the algorithm to have a parallel
double-tap gesture recognizer in the situations where
fast-click is enabled. This new gesture recongizer does
not cause the single tap to block for 350ms, so clicks
are still dispatched fast. If it fires, we already have
some information about whether we have a pending double
tap, based on the first tap.

UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::disableDoubleTapGesturesDuringTapIfNecessary): Remove the optimization
that only told the content view to disable on pages that allowed double taps. We now allow
them even on fast click pages.

UIProcess/ios/WKContentViewInteraction.h: Add the new UITapGestureRecognizer for double taps

in fast click pages. This is called nonBlockingDoubleTapGestureRecognizer because, unlike
the existing DoubleTapGestureRecognizer, this one does not force the singleTapRecognizer
to wait.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView setupInteraction]): Set up the new UITapGestureRecognizer.
(-[WKContentView cleanupInteraction]): And remove it when we're done.
(-[WKContentView _removeDefaultGestureRecognizers]): Ditto.
(-[WKContentView _addDefaultGestureRecognizers]):
(-[WKContentView _inspectorNodeSearchRecognized:]): Something happened, we are no longer in
a potential double tap situation.
(-[WKContentView _disableDoubleTapGesturesDuringTapIfNecessary:]): Remove the check
for potential tap in progress.
(-[WKContentView gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]):
(-[WKContentView gestureRecognizerShouldBegin:]):
(-[WKContentView _highlightLongPressRecognized:]): Again, something happened, so we are
no longer in a double tap situation.
(-[WKContentView _longPressRecognized:]): Ditto.
(-[WKContentView _singleTapRecognized:]): Ditto.
(-[WKContentView _doubleTapRecognized:]): Ditto.
(-[WKContentView _resetIsDoubleTapPending]):
(-[WKContentView _fastDoubleTapRecognized:]): We're now pending a double tap.
(-[WKContentView _twoFingerDoubleTapRecognized:]):
(-[WKContentView _didNotHandleTapAsClick:]): If we get here and we have a pending
double tap, then trigger a zoom operation.
(-[WKContentView _setDoubleTapGesturesEnabled:]):

6:34 PM Changeset in webkit [196678] by Chris Dumez

4 edits in trunk/Source

JSDOMWindow::getOwnPropertySlot should just call getStaticPropertySlot
https://bugs.webkit.org/show_bug.cgi?id=154257

Patch by Gavin Barraclough <barraclough@apple.com> on 2016-02-16
Reviewed by Chris Dumez.

Source/JavaScriptCore:

runtime/Lookup.h:

(JSC::getStaticPropertySlot):
(JSC::getStaticFunctionSlot):
(JSC::getStaticValueSlot):

this could all do with a little more love. But enforce the basic precedence:

(1) regular storage properties always win over static table properties.
(2) if properties have been reified, don't consult the static tables.
(3) only if the property is not present on the object & not reified

should the static hashtable be consulted.

Source/WebCore:

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::getOwnPropertySlot):

JSDOMWindow::getOwnPropertySlot should just call getStaticPropertySlot

6:20 PM Changeset in webkit [196677] by bshafiei@apple.com

1 copy in tags/Safari-601.1.46.100.1

New tag.

5:37 PM Changeset in webkit [196676] by barraclough@apple.com

8 edits in trunk

JSDOMWindow::getOwnPropertySlot should not search photo chain
https://bugs.webkit.org/show_bug.cgi?id=154102

Reviewed by Chris Dumez.

Should only return *own* properties.

Source/JavaScriptCore:

runtime/JSObject.cpp:

(JSC::JSObject::getOwnPropertyDescriptor):

remove hack/special-case for DOMWindow; we no longer need this.

Source/WebCore:

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):

LayoutTests:

fast/dom/Window/es52-globals-expected.txt:
http/tests/security/window-named-valueOf-expected.txt:
imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:
- update test results.

5:29 PM Changeset in webkit [196675] by keith_miller@apple.com

12 edits
1 add in trunk

Spread operator should be allowed when not the first argument of parameter list
https://bugs.webkit.org/show_bug.cgi?id=152721

Reviewed by Saam Barati.

Source/JavaScriptCore:

interpreter/Interpreter.cpp:

(JSC::loadVarargs):

parser/ASTBuilder.h:

(JSC::ASTBuilder::createElementList):

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseArguments):
(JSC::Parser<LexerType>::parseArgument):
(JSC::Parser<LexerType>::parseMemberExpression):

parser/Parser.h:
parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createElementList):

tests/es6.yaml:
tests/stress/spread-calling.js: Added.

(testFunction):
(testEmpty):
(makeObject):
(otherIterator.return.next):
(otherIterator):
(totalIter):
(throwingIter.return.next):
(throwingIter):
(i.catch):

LayoutTests:

Update tests with new semantics of spread calling.

js/basic-spread-expected.txt:
js/parser-syntax-check-expected.txt:
js/script-tests/basic-spread.js:
js/script-tests/parser-syntax-check.js:

5:14 PM Changeset in webkit [196674] by achristensen@apple.com

4 edits in trunk/Source

CMake build fix.

PlatformMac.cmake:

5:11 PM Changeset in webkit [196673] by Chris Dumez

10 edits
2 adds
3 deletes in trunk

Navigator.geolocation should not be marked a [Replaceable] and should be on the prototype
https://bugs.webkit.org/show_bug.cgi?id=154304
<rdar://problem/24685092>

Reviewed by Gavin Barraclough.

LayoutTests/imported/w3c:

Rebaseline test now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Drop the [Replaceable] IDL extended attribute for navigator.geolocation as this does not match other browsers or the specification:
- https://dev.w3.org/geo/api/spec-source.html#geolocation_interface
Move Navigator attributes to the prototype, where they should be as per the Web IDL specification.

The previous behavior was meant as a workaround for a bug in the Amazon
iOS app (rdar://problem/16332749). However, I have confirmed that the
latest Amazon App no longer has any issue with those changes.

Test: js/navigator-set-geolocation.html

Modules/geolocation/NavigatorGeolocation.idl:
bindings/scripts/CodeGeneratorJS.pm:

(InterfaceRequiresAttributesOnInstanceForCompatibility): Deleted.

LayoutTests:

fast/dom/Geolocation/enabled-expected.txt:
fast/dom/Geolocation/script-tests/enabled.js:
js/dom/delete-syntax-expected.txt:
js/dom/script-tests/delete-syntax.js:

Update tests as they expected the navigator properties to be on the
instance rather than the prototype.

js/dom/script-tests/shadow-navigator-geolocation-in-strict-mode-does-not-throw.js: Removed.
js/dom/shadow-navigator-geolocation-in-strict-mode-does-not-throw-expected.txt: Removed.
js/dom/shadow-navigator-geolocation-in-strict-mode-does-not-throw.html: Removed.

Drop outdated test.

js/navigator-set-geolocation-expected.txt: Added.
js/navigator-set-geolocation.html: Added.

Add test to make sure that Navigator.geolocation cannot be set. I verified that
this test passes in both Firefox and Chrome.

4:45 PM Changeset in webkit [196672] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

[JSC] Enable B3 on ARM64
https://bugs.webkit.org/show_bug.cgi?id=154275

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-16
Reviewed by Mark Lam.

The port passes more tests than LLVM now, let's use it by default.

dfg/DFGCommon.h:

4:30 PM Changeset in webkit [196671] by achristensen@apple.com

4 edits in trunk/Source/WebKit2

Use NSURLCredential from serverTrust when evaluating server trust AuthenticationChallenges with NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154316

Reviewed by Brady Eidson.

This fixes http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
and many other layout tests that use https because it allows https connections with servers
with self-signed certificates when TestController::canAuthenticateAgainstProtectionSpace in
WebKitTestRunner says it's OK, or when any other WKPageNavigationClient says it's ok.

NetworkProcess/NetworkDataTask.h:
NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace):

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::serverTrustCredential):

4:00 PM Changeset in webkit [196670] by Said Abou-Hallawa

2 edits in trunk/Source/WebCore

REGRESSION(r196268): WTFCrashWithSecurityImplication on SVG path animation tests
https://bugs.webkit.org/show_bug.cgi?id=154221

Reviewed by Brent Fulgham.

In r196268, a destructor was added to SVGListPropertyTearOff that notifies
its wrapper (the SVGAnimatedListPropertyTearoff) about its deletion. This
allows the wrapper to nullify any references to the wrapped content.

We needed to do the same thing for SVGPathSegListPropertyTearOff. Both
SVGPathSegListPropertyTearOff and SVGListPropertyTearOff inherit from
SVGListProperty and both hold pointers to SVGAnimatedListPropertyTearOff
which needs to be notified.

Tests: exiting svg path animation tests should not crash.

svg/properties/SVGPathSegListPropertyTearOff.h:

(WebCore::SVGPathSegListPropertyTearOff::~SVGPathSegListPropertyTearOff):

3:59 PM Changeset in webkit [196669] by Said Abou-Hallawa

4 edits
2 adds in trunk

REGRESSION (r190430): WTFCrashWithSecurityImplication in:void SVGRootInlineBox::layoutCharactersInTextBoxes()
https://bugs.webkit.org/show_bug.cgi?id=154185

Reviewed by Ryosuke Niwa.
Source/WebCore:

This is a regression caused by adding support for HTMLSlotElement. The
crash happens when adding an HTMLSlotElement to anther element which should
not have it as a child like SVGTextElement for example. In this case, we
were creating a RenderText which should not be happen inside an SVG document.
The RenderText::createTextBox() was creating InlineTextBox for the slot's
text and attach it to the SVGRootInlineBox. In layoutCharactersInTextBoxes(),
the assumption is the inline box is either SVGInlineTextBox or SVGInlineFlowBox.
But since we have an InlineTextBox instead, the crash happens when casting
the InlineTextBox to SVGInlineFlowBox.

The fix is for createRenderTreeForSlotAssignees() to not create a renderer
when the parent element should not have a renderer for the this element.
This is the same thing we do for createRenderer() which handles the non
HTMLSlotElement case and which is called also from createRenderTreeRecursively().

Test: fast/shadow-dom/text-slot-child-crash.svg

style/StyleTreeResolver.cpp:

(WebCore::Style::moveToFlowThreadIfNeeded):
(WebCore::Style::TreeResolver::createRenderer): Delete the check for
shouldCreateRenderer() and handling the case when resolvedStyle is null
since these are handled by the caller createRenderTreeRecursively().

(WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
Assert shouldCreateRenderer() is true for this element.

(WebCore::Style::TreeResolver::createRenderTreeRecursively): Don't create
the renderer if shouldCreateRenderer() returns false. Also handle the case
when resolvedStyle is null and pass the new style to createRenderer().

style/StyleTreeResolver.h:

LayoutTests:

Ensure that adding an HTMLSlotElement with text to an SVGTextElement will
not create a renderer and we won't crash.

fast/shadow-dom/text-slot-child-crash-expected.txt: Added.
fast/shadow-dom/text-slot-child-crash.svg: Added.

3:47 PM Changeset in webkit [196668] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r196652.
https://bugs.webkit.org/show_bug.cgi?id=154315

This change caused LayoutTest crashes (Requested by ryanhaddad
on #webkit).

Reverted changeset:

"FTL should support NewTypedArray"
https://bugs.webkit.org/show_bug.cgi?id=154268
http://trac.webkit.org/changeset/196652

3:45 PM Changeset in webkit [196667] by BJ Burg

4 edits in trunk/Source/JavaScriptCore

RemoteInspector should forward new automation session requests to its client
https://bugs.webkit.org/show_bug.cgi?id=154260
<rdar://problem/24663313>

Reviewed by Timothy Hatcher.

inspector/remote/RemoteInspector.h:
inspector/remote/RemoteInspector.mm:

(Inspector::RemoteInspector::xpcConnectionReceivedMessage):
(Inspector::RemoteInspector::listingForAutomationTarget):
Use the correct key for the session identifier in the listing. The name()
override for RemoteAutomationTarget is actually the session identifier.

(Inspector::RemoteInspector::receivedAutomationSessionRequestMessage):

inspector/remote/RemoteInspectorConstants.h: Add new constants.

3:24 PM Changeset in webkit [196666] by Simon Fraser

3 edits in trunk/Source/WebCore

Every RenderLayer should not have to remove itself from the scrollableArea set
https://bugs.webkit.org/show_bug.cgi?id=154311

Reviewed by Zalan Bujtas.

A subset of RenderLayers are are scrollable, and get registered on the FrameView,
but we pay the cost of a hash lookup for removal on every RenderLayer, which is a waste.

Store a bit that tells RenderLayer that it's in the set and needs to be removed.

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::RenderLayer):
(WebCore::RenderLayer::~RenderLayer):
(WebCore::RenderLayer::calculateClipRects):

rendering/RenderLayer.h:

3:24 PM Changeset in webkit [196665] by Simon Fraser

3 edits
5 adds in trunk/LayoutTests

Add tests for iframe and overflow scrollability after navigating back
https://bugs.webkit.org/show_bug.cgi?id=154300

Reviewed by Brent Fulgham.

Test that sends mousewheel events to overflow and iframe, before and after navigating
forward then back.

These tests detect the regression caused by r188659.

fast/scrolling/iframe-scrollable-after-back-expected.txt: Added.
fast/scrolling/iframe-scrollable-after-back.html: Added.
fast/scrolling/overflow-scrollable-after-back-expected.txt: Added.
fast/scrolling/overflow-scrollable-after-back.html: Added.
fast/scrolling/resources/scroll-notifying-page.html: Added.
platform/ios-simulator/TestExpectations: Skip on iOS.

3:22 PM Changeset in webkit [196664] by dbates@webkit.org

12 edits in trunk

CSP: Update violation report 'Content-Type' header
https://bugs.webkit.org/show_bug.cgi?id=153166
<rdar://problem/24383327>

Reviewed by Brent Fulgham.

Source/WebCore:

Inspired by Blink patch:
<https://src.chromium.org/viewvc/blink?view=rev&revision=154215>

Post the Content Security Policy violation report with Content-Type application/csp-report as
per section Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

Currently we post CSP violation reports with Content-Type application/json.

html/parser/XSSAuditorDelegate.cpp:

(WebCore::XSSAuditorDelegate::didBlockScript): Use report type ViolationReportType::XSSAuditor to PingLoader.

loader/PingLoader.cpp:

(WebCore::PingLoader::sendViolationReport): Modified to take argument of type ViolationReportType
to determine the appropriate Content-Type header to use for the report. For a XSS Auditor violation report
we use Content-Type application/json. For a Content Security Policy violation report we use Content-Type
application/csp-report. Additionally, pass a ASCIILiteral() to ResourceRequestBase::setHTTPMethod()
as opposed to a constant string literal to avoid a copy of a constant string literal.

loader/PingLoader.h: Add enum class ViolationReportType.
page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation): Use report type ViolationReportType::ContentSecurityPolicy.

LayoutTests:

Update expected results now that we post the Content Security Policy violation report with
Content-Type application/csp-report.

TestExpectations: Update associated bugs for entries that still fail.
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt:
http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-toggled-expected.txt:
http/tests/security/contentSecurityPolicy/report-same-origin-no-cookies-when-private-browsing-toggled-expected.txt:
http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt:
http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt: Fix up HTTP_REFERER and csp-report

to reflect the correct value for HTTP_REFERER and the correct values for the report-uri and document-uri keys in the CSP
report JSON object.

3:16 PM Changeset in webkit [196663] by rniwa@webkit.org

6 edits
1 add in trunk/Websites/perf.webkit.org

Extract the code specific to v2 UI out of shared statistics.js
https://bugs.webkit.org/show_bug.cgi?id=154277

Reviewed by Chris Dumez.

Extracted statistics-strategies.js out of statistics.js for v2 UI and detect-changes.js. The intent is to
deprecate this file once we implement refined statistics tools in v3 UI and adopt it in detect-changes.js.

public/shared/statistics.js:

(Statistics.movingAverage): Extracted from the "Simple Moving Average" strategy.
(Statistics.cumultaiveMovingAverage): Extracted from the "Cumulative Moving Average" strategy.
(Statistics.exponentialMovingAverage): Extracted from the "Exponential Moving Average" strategy.
Use a temporary "movingAverage" to keep the last moving average instead of relying on the previous
entry in "averages" array to avoid special casing an array of length 1 and starting the loop at i = 1.
(Statistics.segmentTimeSeriesGreedyWithStudentsTTest): Extracted from "Segmentation: Recursive t-test"
strategy. Don't create the list of averages to match segmentTimeSeriesByMaximizingSchwarzCriterion here.
It's done in newly added averagesFromSegments.
(Statistics.segmentTimeSeriesByMaximizingSchwarzCriterion): Extracted from
"Segmentation: Schwarz criterion" strategy.
(.recursivelySplitIntoTwoSegmentsAtMaxTIfSignificantlyDifferent): Just store the start index to match

public/v2/app.js:

(App.Pane.updateStatisticsTools):
(App.Pane._computeMovingAverageAndOutliers):

public/v2/data.js:
public/v2/index.html:
public/v2/statistics-strategies.js: Added.

(StatisticsStrategies.MovingAverageStrategies): Added.
(averagesFromSegments): Extracted from "Segmentation: Schwarz criterion" strategy. Now used by both
"Segmentation: Recursive t-test" and "Segmentation: Schwarz criterion" strategies.
(StatisticsStrategies.EnvelopingStrategies): Moved from Statistics.EnvelopingStrategies.
(StatisticsStrategies.TestRangeSelectionStrategies): Moved from Statistics.TestRangeSelectionStrategies.
(createWesternElectricRule): Moved from statistics.js.
(countValuesOnSameSide): Ditto.
(StatisticsStrategies.executeStrategy): Moved from Statistics.executeStrategy.

tools/detect-changes.js:

(computeRangesForTesting):

3:13 PM Changeset in webkit [196662] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking pageoverlay/overlay-installation.html as flaky on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=153337

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

2:57 PM Changeset in webkit [196661] by andersca@apple.com

13 edits
1 delete in trunk/Source/WebKit2

Use pid_t everywhere, instead of PlatformProcessIdentifier
https://bugs.webkit.org/show_bug.cgi?id=154306

Reviewed by Sam Weinig.

Platform/IPC/Connection.h:
Platform/PlatformProcessIdentifier.h: Removed.
UIProcess/API/efl/tests/test_ewk2_context.cpp:

(TEST_F):

UIProcess/ChildProcessProxy.h:

(WebKit::ChildProcessProxy::processIdentifier):

UIProcess/Launcher/ProcessLauncher.cpp:

(WebKit::ProcessLauncher::didFinishLaunchingProcess):

UIProcess/Launcher/ProcessLauncher.h:

(WebKit::ProcessLauncher::processIdentifier):

UIProcess/Launcher/mac/ProcessLauncherMac.mm:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::processIdentifier):

UIProcess/WebPageProxy.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::networkProcessIdentifier):

UIProcess/WebProcessPool.h:
UIProcess/WebProcessProxy.h:
WebKit2.xcodeproj/project.pbxproj:

2:54 PM Changeset in webkit [196660] by andersca@apple.com

2 edits
2 deletes in trunk/Source/WebKit2

Remove WebKit2 header cruft
https://bugs.webkit.org/show_bug.cgi?id=154309

Reviewed by Sam Weinig.

WebKit2.xcodeproj/project.pbxproj:
mac/WKError.h: Removed.
mac/WKPreferences.h: Removed.

2:43 PM Changeset in webkit [196659] by andersca@apple.com

3 edits
4 deletes in trunk/Source/WebKit2

Remove unused environment variable classes
https://bugs.webkit.org/show_bug.cgi?id=154308

Reviewed by Tim Horton.

UIProcess/Launcher/mac/DynamicLinkerEnvironmentExtractor.h: Removed.
UIProcess/Launcher/mac/DynamicLinkerEnvironmentExtractor.mm: Removed.

(WebKit::DynamicLinkerEnvironmentExtractor::DynamicLinkerEnvironmentExtractor): Deleted.
(WebKit::DynamicLinkerEnvironmentExtractor::processEnvironmentVariable): Deleted.
(WebKit::DynamicLinkerEnvironmentExtractor::processLoadCommand): Deleted.
(WebKit::DynamicLinkerEnvironmentExtractor::processLoadCommands): Deleted.
(WebKit::DynamicLinkerEnvironmentExtractor::processSingleArchitecture): Deleted.
(WebKit::DynamicLinkerEnvironmentExtractor::processFatFile): Deleted.
(WebKit::DynamicLinkerEnvironmentExtractor::getExtractedEnvironmentVariables): Deleted.

UIProcess/Launcher/mac/EnvironmentVariables.cpp: Removed.

(WebKit::EnvironmentVariables::EnvironmentVariables): Deleted.
(WebKit::EnvironmentVariables::~EnvironmentVariables): Deleted.
(WebKit::EnvironmentVariables::set): Deleted.
(WebKit::EnvironmentVariables::get): Deleted.
(WebKit::EnvironmentVariables::appendValue): Deleted.
(WebKit::EnvironmentVariables::valueIfVariableHasName): Deleted.
(WebKit::EnvironmentVariables::createStringForVariable): Deleted.
(WebKit::EnvironmentVariables::copyEnvironmentVariables): Deleted.
(WebKit::EnvironmentVariables::dump): Deleted.

UIProcess/Launcher/mac/EnvironmentVariables.h: Removed.

(WebKit::EnvironmentVariables::environmentPointer): Deleted.

UIProcess/Launcher/mac/ProcessLauncherMac.mm:
WebKit2.xcodeproj/project.pbxproj:

2:01 PM Changeset in webkit [196658] by sbarati@apple.com

6 edits in trunk/Source/JavaScriptCore

SamplingProfiler still fails with ASan enabled
https://bugs.webkit.org/show_bug.cgi?id=154301
<rdar://problem/24679502>

Reviewed by Filip Pizlo.

To fix this issue, I've come up with unsafe versions
of all operations that load memory from the thread's call
frame. All these new unsafe methods are marked with SUPPRESS_ASAN.

interpreter/CallFrame.cpp:

(JSC::CallFrame::callSiteAsRawBits):
(JSC::CallFrame::unsafeCallSiteAsRawBits):
(JSC::CallFrame::callSiteIndex):
(JSC::CallFrame::unsafeCallSiteIndex):
(JSC::CallFrame::stack):
(JSC::CallFrame::callerFrame):
(JSC::CallFrame::unsafeCallerFrame):
(JSC::CallFrame::friendlyFunctionName):

interpreter/CallFrame.h:

(JSC::ExecState::calleeAsValue):
(JSC::ExecState::callee):
(JSC::ExecState::unsafeCallee):
(JSC::ExecState::codeBlock):
(JSC::ExecState::unsafeCodeBlock):
(JSC::ExecState::scope):
(JSC::ExecState::callerFrame):
(JSC::ExecState::callerFrameOrVMEntryFrame):
(JSC::ExecState::unsafeCallerFrameOrVMEntryFrame):
(JSC::ExecState::callerFrameOffset):
(JSC::ExecState::callerFrameAndPC):
(JSC::ExecState::unsafeCallerFrameAndPC):

interpreter/Register.h:

(JSC::Register::codeBlock):
(JSC::Register::asanUnsafeCodeBlock):
(JSC::Register::unboxedInt32):
(JSC::Register::tag):
(JSC::Register::unsafeTag):
(JSC::Register::payload):

interpreter/VMEntryRecord.h:

(JSC::VMEntryRecord::prevTopCallFrame):
(JSC::VMEntryRecord::unsafePrevTopCallFrame):
(JSC::VMEntryRecord::prevTopVMEntryFrame):
(JSC::VMEntryRecord::unsafePrevTopVMEntryFrame):

runtime/SamplingProfiler.cpp:

(JSC::FrameWalker::walk):
(JSC::FrameWalker::advanceToParentFrame):
(JSC::FrameWalker::isAtTop):
(JSC::FrameWalker::resetAtMachineFrame):

1:42 PM Changeset in webkit [196657] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196648

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

1:25 PM Changeset in webkit [196656] by achristensen@apple.com

7 edits in trunk/Source

Add checks before redirecting with NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154298

Reviewed by Andy Estes.

Source/WebCore:

This fixes http/tests/security/cors-post-redirect-307.html and
http/tests/navigation/post-307-response.html when using NetworkSession.

platform/network/ResourceRequestBase.h:

WEBCORE_EXPORT some functions newly used in WebKit2.

Source/WebKit2:

NetworkProcess/NetworkDataTask.h:

(WebKit::NetworkDataTask::create):
(WebKit::NetworkDataTask::setPendingDownload):

NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad):

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::NetworkDataTask):
(WebKit::NetworkDataTask::~NetworkDataTask):
(WebKit::NetworkDataTask::willPerformHTTPRedirection):
Implemented based on ResourceHandle::willSendRequest but with two notable exceptions:

When using NSURLConnection, the last http method and the current http method are not always equal, and this

check needs to change the current http method to match the last http method when being redirected with an http
status code 307. When using NSURLSession, the current http method is already updated properly.

I did not copy the part of ResourceHandle::willSendRequest that uses a CredentialStorage. I'm trying to avoid

using CredentialStorages with NSURLSession.
(WebKit::NetworkDataTask::scheduleFailure):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]):

1:18 PM Changeset in webkit [196655] by dbates@webkit.org

4 edits in trunk

CSP: Fix parsing of 'host/path' source expressions
https://bugs.webkit.org/show_bug.cgi?id=153170
<rdar://problem/24383407>

Reviewed by Brent Fulgham.

Source/WebCore:

Merged from Blink (patch by Mike West):
<https://src.chromium.org/viewvc/blink?revision=154875&view=revision>

Fixes an issue where a source of the form example.com/A/ was incorrectly considered
invalid and hence such a requested resource would be blocked. A source of this form
is valid by the definition of host-source in section Source List Syntax of the Content
Security Policy 2.0 spec., <http://www.w3.org/TR/2015/CR-CSP2-20150721/>.

page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::parseSource):

LayoutTests:

Remove entry for test http/tests/security/contentSecurityPolicy/source-list-parsing-paths-03.html
as it now passes.

TestExpectations:

1:17 PM Changeset in webkit [196654] by commit-queue@webkit.org

7 edits
2 adds in trunk

JSContext Inspector: Support for inline source maps
https://bugs.webkit.org/show_bug.cgi?id=154303
<rdar://problem/24670392>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-16
Reviewed by Timothy Hatcher.

Source/WebInspectorUI:

UserInterface/Base/URLUtilities.js:

(parseDataURL):
Break a data URL into components.

UserInterface/Controllers/SourceMapManager.js:

(WebInspector.SourceMapManager.prototype._loadAndParseSourceMap):
Handle a data URL without using NetworkAgent. Also move references
to a main frame after checking for NetworkAgent.

UserInterface/Models/SourceMap.js:

(WebInspector.SourceMap.prototype.get sourceMappingBasePathURLComponents):

UserInterface/Models/SourceMapResource.js:

(WebInspector.SourceMapResource.prototype.get sourceMapDisplaySubpath):
Handle JavaScript debuggable script URLs which may not be complete URLs.

(WebInspector.SourceMapResource.prototype.requestContentFromBackend):
Also handle if NetworkAgent does not exist.

UserInterface/Views/ResourceSidebarPanel.js:

(WebInspector.ResourceSidebarPanel):
When connected to a JavaScript debuggable we were hiding disclosure
triangles as we did not expect resources to have subresources. If
a SourceMap is added, show them again.

LayoutTests:

inspector/unit-tests/url-utilities-expected.txt: Added.
inspector/unit-tests/url-utilities.html: Added.

1:16 PM Changeset in webkit [196653] by dbates@webkit.org

4 edits in trunk

CSP: Disallow an empty host in a host-source source expression
https://bugs.webkit.org/show_bug.cgi?id=153168
<rdar://problem/24383366>

Reviewed by Brent Fulgham.

Source/WebCore:

Merged from Blink (patch by rob@robwu.nl):
<https://src.chromium.org/viewvc/blink?revision=180407&view=revision>

page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::parseSource):

LayoutTests:

Remove entry for test http/tests/security/contentSecurityPolicy/source-list-parsing-07.html
as it now passes.

TestExpectations:

1:12 PM Changeset in webkit [196652] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

FTL should support NewTypedArray
https://bugs.webkit.org/show_bug.cgi?id=154268

Reviewed by Saam Barati.

3% speed-up on pdfjs. This was already covered by many different tests.

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToLLVM.cpp:

12:58 PM Changeset in webkit [196651] by beidson@apple.com

15 edits
4 adds in trunk/Source

Modern IDB: WK2 IPC Scaffolding.
https://bugs.webkit.org/show_bug.cgi?id=154296

Reviewed by Alex Christensen.

No change in behavior yet; Just laying the groundwork.

Source/WebCore:

Modules/indexeddb/client/IDBConnectionToServer.h:
Modules/indexeddb/server/IDBConnectionToClient.h:
Modules/indexeddb/shared/IDBResourceIdentifier.h:

Source/WebKit2:

CMakeLists.txt:
WebKit2.xcodeproj/project.pbxproj:

DatabaseProcess/DatabaseToWebProcessConnection.cpp:

(WebKit::DatabaseToWebProcessConnection::establishIDBConnectionToServer):
(WebKit::DatabaseToWebProcessConnection::removeIDBConnectionToServer):

DatabaseProcess/DatabaseToWebProcessConnection.h:
DatabaseProcess/DatabaseToWebProcessConnection.messages.in:

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.cpp: Added.

(WebKit::WebIDBConnectionToClient::create):
(WebKit::WebIDBConnectionToClient::WebIDBConnectionToClient):
(WebKit::WebIDBConnectionToClient::~WebIDBConnectionToClient):
(WebKit::WebIDBConnectionToClient::disconnectedFromWebProcess):
(WebKit::WebIDBConnectionToClient::messageSenderConnection):
(WebKit::WebIDBConnectionToClient::connectionToClient):
(WebKit::WebIDBConnectionToClient::didDeleteDatabase):
(WebKit::WebIDBConnectionToClient::didOpenDatabase):
(WebKit::WebIDBConnectionToClient::didAbortTransaction):
(WebKit::WebIDBConnectionToClient::didCommitTransaction):
(WebKit::WebIDBConnectionToClient::didCreateObjectStore):
(WebKit::WebIDBConnectionToClient::didDeleteObjectStore):
(WebKit::WebIDBConnectionToClient::didClearObjectStore):
(WebKit::WebIDBConnectionToClient::didCreateIndex):
(WebKit::WebIDBConnectionToClient::didDeleteIndex):
(WebKit::WebIDBConnectionToClient::didPutOrAdd):
(WebKit::WebIDBConnectionToClient::didGetRecord):
(WebKit::WebIDBConnectionToClient::didGetCount):
(WebKit::WebIDBConnectionToClient::didDeleteRecord):
(WebKit::WebIDBConnectionToClient::didOpenCursor):
(WebKit::WebIDBConnectionToClient::didIterateCursor):
(WebKit::WebIDBConnectionToClient::fireVersionChangeEvent):
(WebKit::WebIDBConnectionToClient::didStartTransaction):
(WebKit::WebIDBConnectionToClient::notifyOpenDBRequestBlocked):

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h: Added.

Platform/Logging.h:

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp: Added.

(WebKit::generateConnectionToServerIdentifier):
(WebKit::WebIDBConnectionToServer::create):
(WebKit::WebIDBConnectionToServer::WebIDBConnectionToServer):
(WebKit::WebIDBConnectionToServer::~WebIDBConnectionToServer):
(WebKit::WebIDBConnectionToServer::messageSenderConnection):
(WebKit::WebIDBConnectionToServer::coreConnectionToServer):
(WebKit::WebIDBConnectionToServer::deleteDatabase):
(WebKit::WebIDBConnectionToServer::openDatabase):
(WebKit::WebIDBConnectionToServer::abortTransaction):
(WebKit::WebIDBConnectionToServer::commitTransaction):
(WebKit::WebIDBConnectionToServer::didFinishHandlingVersionChangeTransaction):
(WebKit::WebIDBConnectionToServer::createObjectStore):
(WebKit::WebIDBConnectionToServer::deleteObjectStore):
(WebKit::WebIDBConnectionToServer::clearObjectStore):
(WebKit::WebIDBConnectionToServer::createIndex):
(WebKit::WebIDBConnectionToServer::deleteIndex):
(WebKit::WebIDBConnectionToServer::putOrAdd):
(WebKit::WebIDBConnectionToServer::getRecord):
(WebKit::WebIDBConnectionToServer::getCount):
(WebKit::WebIDBConnectionToServer::deleteRecord):
(WebKit::WebIDBConnectionToServer::openCursor):
(WebKit::WebIDBConnectionToServer::iterateCursor):
(WebKit::WebIDBConnectionToServer::establishTransaction):
(WebKit::WebIDBConnectionToServer::databaseConnectionClosed):
(WebKit::WebIDBConnectionToServer::abortOpenAndUpgradeNeeded):
(WebKit::WebIDBConnectionToServer::didFireVersionChangeEvent):

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.h: Added.

WebProcess/Databases/WebDatabaseProvider.cpp:

(WebKit::WebDatabaseProvider::idbConnectionToServerForSession):

WebProcess/Databases/WebDatabaseProvider.h:

WebProcess/Databases/WebToDatabaseProcessConnection.cpp:

(WebKit::WebToDatabaseProcessConnection::idbConnectionToServerForSession):

WebProcess/Databases/WebToDatabaseProcessConnection.h:

12:50 PM Changeset in webkit [196650] by sbarati@apple.com

2 edits in trunk/Source/JavaScriptCore

stress/sampling-profiler-deep-stack.js fails on ARM 32bit
https://bugs.webkit.org/show_bug.cgi?id=154255
<rdar://problem/24662996>

Reviewed by Mark Lam.

The bug here wasn't in the implementation of the sampling profiler
itself. Rather, it was a bug in the test. JSC wasn't spending a lot
of time in a function that the test assumed a lot of time was spent in.
That's because the DFG was doing a good job at optimizing the function
at the leaf of the recursion. Because of that, we often wouldn't sample it.
I fixed this by making the leaf function do more work.

tests/stress/sampling-profiler-deep-stack.js:

(platformSupportsSamplingProfiler.foo):

12:35 PM Changeset in webkit [196649] by bshafiei@apple.com

3 edits in branches/safari-601.1.46-branch/Source/WebKit2

Merged r196645. rdar://problem/24679618

12:23 PM Changeset in webkit [196648] by Chris Dumez

13 edits in trunk

[Web IDL] Operations should be on the instance for global objects or if [Unforgeable]
https://bugs.webkit.org/show_bug.cgi?id=154120
<rdar://problem/24613231>

Reviewed by Gavin Barraclough.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/JavaScriptCore:

Have putEntry() take a thisValue parameter in addition to the base,
instead of relying on PropertySlot::thisValue() because this did not
always do the right thing. In particular, when JSDOMWindow::put() was
called to set a function, it would end up setting the new value on the
JSDOMWindowShell instead of the actual JSDOMWindow.
JSDOMWindow::getOwnPropertySlot() would then not be able to find it.
Therefore the following would fail:
$ window.open = "test"
$ console.log(window.open) prints the native function instead of "test"

runtime/JSObject.cpp:

(JSC::JSObject::putInlineSlow):

runtime/Lookup.h:

(JSC::putEntry):
(JSC::lookupPut):

Source/WebCore:

Operations should be on the instance for global objects or if
[Unforgeable] as per the Web IDL specification:

This patch implements this behavior in order to align
with the specification and other browsers.

No new tests, already covered by existing tests.

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
Update function names now that they have "Instance" in their
name instead of "Prototype".

(WebCore::JSDOMWindow::getOwnPropertySlot):

Update function names now that they have "Instance" in their name instead of "Prototype".
Move the functions hard-coding *before* the static table check now that these functions are in the static table to maintain the previous behavior.

bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::getOwnPropertySlotDelegate):
Update function names now that they have "Instance" in their
name instead of "Prototype".

bindings/scripts/CodeGeneratorJS.pm:
Move functions to the instance if their interface is a global object or if they are marked as [Unforgeable]. Operations are now treated more like attributes, as they can now be either on the instance or the prototype. In a lot of places, I now use the naming "properties" instead of "attributes" as "properties" refer both "attributes" and "operations" / "functions".

bindings/scripts/test/JS/JSTestInterface.cpp:
bindings/scripts/test/JS/JSTestObj.cpp:

Rebaseline bindings tests.

LayoutTests:

inspector/model/remote-object-get-properties-expected.txt:

Rebaseline test because the order of static properties has changed:
functions are now before constants instead of after.

12:18 PM Changeset in webkit [196647] by Jon Davis

2 edits in trunk/Websites/webkit.org

Add a redirect for B3 documentation
https://bugs.webkit.org/show_bug.cgi?id=154293

Reviewed by Timothy Hatcher.

.htaccess:

11:53 AM Changeset in webkit [196646] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking webarchive/loading/missing-data.html as flaky on ios-simulator-wk2
https://bugs.webkit.org/show_bug.cgi?id=153380

Unreviewed test gardening.

platform/ios-simulator-wk2/TestExpectations:

11:33 AM Changeset in webkit [196645] by weinig@apple.com

3 edits in trunk/Source/WebKit2

Revert r195826.

Platform/spi/ios/UIKitSPI.h:
UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _createAndConfigureDoubleTapGestureRecognizer]):
(-[WKContentView _singleTapCommited:]):

11:28 AM Changeset in webkit [196644] by keith_miller@apple.com

4 edits
1 add in trunk

ClonedArguments should not materialize its special properties unless they are being changed or deleted
https://bugs.webkit.org/show_bug.cgi?id=154128

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Before we would materialize ClonedArguments whenever they were being accessed.
However this would cause the IC to miss every time as the structure for
the arguments object would change as we went to IC it. Thus on the next
function call we would miss the cache since the new arguments object
would not have materialized the value.

runtime/ClonedArguments.cpp:

(JSC::ClonedArguments::getOwnPropertySlot):

tests/stress/cloned-arguments-modification.js: Added.

(foo):

LayoutTests:

Have argumnets-strict-mode test the speed of spreading the arguments object.

js/regress/script-tests/arguments-strict-mode.js:

(foo):

11:13 AM Changeset in webkit [196643] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking fast/events/keydown-1.html as flaky on mac-wk1 debug
https://bugs.webkit.org/show_bug.cgi?id=154297

Unreviewed test gardening.

platform/mac-wk1/TestExpectations:

11:12 AM Changeset in webkit [196642] by fpizlo@apple.com

5 edits
7 adds in trunk

FTL should support StringFromCharCode
https://bugs.webkit.org/show_bug.cgi?id=154267
Source/JavaScriptCore:

rdar://problem/24192536

Reviewed by Mark Lam.

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode): Fix a bug preventing the UntypedUse from being effective.

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
(JSC::FTL::DFG::LowerDFGToLLVM::compileStringFromCharCode): Implement the opcode.

tests/stress/string-from-char-code-slow.js: Added.

LayoutTests:

Reviewed by Mark Lam.

js/regress/script-tests/string-from-char-code.js: Added.

(result):

js/regress/script-tests/untyped-string-from-char-code.js: Added.

(result):

js/regress/string-from-char-code-expected.txt: Added.
js/regress/string-from-char-code.html: Added.
js/regress/untyped-string-from-char-code-expected.txt: Added.
js/regress/untyped-string-from-char-code.html: Added.

10:48 AM Changeset in webkit [196641] by Simon Fraser

4 edits in trunk/Source/WebCore

Rollout r188659. This broke scrolling of iframes and overflow when
navigating back to a page in the page cache.

The fix was overly agressive and had no layout test. I will fix the original
issue a different way.

history/CachedFrame.cpp:

(WebCore::CachedFrame::CachedFrame):

page/FrameView.cpp:

(WebCore::FrameView::clearScrollableAreas): Deleted.

page/FrameView.h:

10:15 AM Changeset in webkit [196640] by Carlos Garcia Campos

4 edits
2 adds in trunk

[GTK] No hover-horizontal scrolling available
https://bugs.webkit.org/show_bug.cgi?id=122859

Reviewed by Michael Catanzaro.

Source/WebCore:

Test: platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll.html

page/EventHandler.cpp:

(WebCore::EventHandler::handleWheelEvent): Pass the adjusted wheel
event to platformCompleteWheelEvent().

page/gtk/EventHandlerGtk.cpp:

(WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
Check also frame scrollbars.

LayoutTests:

platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll-expected.html: Added.
platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll.html: Added.

10:13 AM Changeset in webkit [196639] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/LayoutTests/loader/stateobjects

Fix pushstate tests. rdar://problem/24527863

10:12 AM Changeset in webkit [196638] by matthew_hanson@apple.com

1 edit
2 adds in branches/safari-601-branch/LayoutTests

Address Font Variant test failures. rdar://problem/24494903

9:59 AM Changeset in webkit [196637] by matthew_hanson@apple.com

6 edits in branches/safari-601-branch/Source/WebCore

Fix for rdar://problem/24494562

9:24 AM Changeset in webkit [196636] by Antti Koivisto

10 edits
4 adds in trunk

Factor id mutation style invalidation code into a class
https://bugs.webkit.org/show_bug.cgi?id=154287

Reviewed by Andreas Kling.

Source/WebCore:

Also add a cheap basic optimization that avoids descendant invalidation if they can not be affected.

It would be easy to implement fine grained invalidation like with classes and attribute selectors.
However dynamic id changes are not common enough (nor recommended) to pay the memory cost of
the required data structures.

Test: fast/css/style-invalidation-id-change-descendants.html

CMakeLists.txt:
WebCore.vcxproj/WebCore.vcxproj:
WebCore.xcodeproj/project.pbxproj:
css/RuleFeature.cpp:

(WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
(WebCore::RuleFeatureSet::add):
(WebCore::RuleFeatureSet::clear):

css/RuleFeature.h:
dom/Element.cpp:

(WebCore::makeIdForStyleResolution):
(WebCore::Element::attributeChanged):
(WebCore::checkNeedsStyleInvalidationForIdChange): Deleted.

style/IdChangeInvalidation.cpp: Added.

(WebCore::Style::IdChangeInvalidation::invalidateStyle):

style/IdChangeInvalidation.h: Added.

(WebCore::Style::IdChangeInvalidation::IdChangeInvalidation):
(WebCore::Style::IdChangeInvalidation::~IdChangeInvalidation):

LayoutTests:

fast/css/style-invalidation-id-change-descendants-expected.txt: Added.
fast/css/style-invalidation-id-change-descendants.html: Added.

9:12 AM Changeset in webkit [196635] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196621

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

8:42 AM Changeset in webkit [196634] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Increase the width of the find banner's search field
https://bugs.webkit.org/show_bug.cgi?id=154284

Reviewed by Timothy Hatcher.

UserInterface/Views/FindBanner.css:

(.find-banner > input[type="search"]):
Keep the minimum width the same as the current width.

(body .find-banner.console-find-banner):
Overwrite ".navigation-bar .item {flex-wrap: nowrap}".

2:00 AM Changeset in webkit [196633] by akling@apple.com

12 edits in trunk/Source

Drop StyleResolver and SelectorQueryCache when entering PageCache.
<https://webkit.org/b/154238>

Reviewed by Antti Koivisto.

Source/WebCore:

Stop keeping these around for cached pages to save lots of memory.
We can easily rebuild them if a cached navigation occurs, and this
way we also don't need to worry about invalidating style for cached
pages in all the right places.

Restoring a cached page will now lead to a forced style recalc.
We don't try to defer this (beyond a zero-timer) since it's going
to happen anyway, and it's nicer to front-load the cost rather than
stuttering on the first user content interaction.

dom/Document.cpp:

(WebCore::Document::setInPageCache):

history/CachedPage.cpp:

(WebCore::CachedPage::restore):
(WebCore::CachedPage::clear): Deleted.

history/CachedPage.h:

(WebCore::CachedPage::markForVisitedLinkStyleRecalc): Deleted.
(WebCore::CachedPage::markForFullStyleRecalc): Deleted.

history/PageCache.cpp:

(WebCore::PageCache::markPagesForVisitedLinkStyleRecalc): Deleted.
(WebCore::PageCache::markPagesForFullStyleRecalc): Deleted.

history/PageCache.h:
page/Frame.cpp:

(WebCore::Frame::setPageAndTextZoomFactors): Deleted.

page/Page.cpp:

(WebCore::Page::setViewScaleFactor): Deleted.
(WebCore::Page::setDeviceScaleFactor): Deleted.
(WebCore::Page::setPagination): Deleted.
(WebCore::Page::setPaginationLineGridEnabled): Deleted.
(WebCore::Page::setVisitedLinkStore): Deleted.

Source/WebKit/win:

WebCoreSupport/WebVisitedLinkStore.cpp:

(WebVisitedLinkStore::removeAllVisitedLinks): Deleted.
(WebVisitedLinkStore::addVisitedLinkHash): Deleted.

1:50 AM Changeset in webkit [196632] by Carlos Garcia Campos

14 edits in trunk/Source/WebCore

[GTK] clicking on the scrollbar trough steps rather than jumps to the clicked position
https://bugs.webkit.org/show_bug.cgi?id=115363

Reviewed by Michael Catanzaro.

Allow ScrollbarTheme to decide the behavior of a button press event,
instead of only deciding whether to center on thumb or not. This
way we can match the current GTK+ behavior in WebKit, without
affecting other ports.

platform/ScrollTypes.h: Add ScrollbarButtonPressAction enum.
platform/Scrollbar.cpp:

(WebCore::Scrollbar::mouseDown): Ask ScrollbarTheme to handle the
event for the pressed part and do the requested action.

platform/ScrollbarTheme.cpp:

(WebCore::ScrollbarTheme::handleMousePressEvent): Add default
implementation. It's equivalent to the previous default implementation.

platform/ScrollbarTheme.h:
platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::handleMousePressEvent): Match current
GTK+ behavior: left click centers on thumb and right click
scrolls. Dragging the thumb works for left and middle buttons.

platform/gtk/ScrollbarThemeGtk.h:
platform/ios/ScrollbarThemeIOS.h: Remove shouldCenterOnThumb,

and don't override handleMousePressEvent since iOS wants the
default behavior.

platform/ios/ScrollbarThemeIOS.mm:
platform/mac/ScrollbarThemeMac.h: Override handleMousePressEvent

and remove shouldCenterOnThumb.

platform/mac/ScrollbarThemeMac.mm:

(WebCore::shouldCenterOnThumb): Same implementation just made it
static to be used as helper.
(WebCore::ScrollbarThemeMac::handleMousePressEvent): Return the
desired action keeping the same behavior.

platform/win/ScrollbarThemeWin.cpp:

(WebCore::ScrollbarThemeWin::handleMousePressEvent): Ditto.

platform/win/ScrollbarThemeWin.h:
rendering/RenderScrollbarTheme.h:

1:45 AM Changeset in webkit [196631] by Carlos Garcia Campos

2 edits in trunk/Source/WebCore

Mouse cursor doesn't change when entering scrollbars
https://bugs.webkit.org/show_bug.cgi?id=154243

Reviewed by Simon Fraser.

page/EventHandler.cpp:

(WebCore::EventHandler::updateCursor): Request also to include
frame scrollbars in hit test result.
(WebCore::EventHandler::selectCursor): Use always pointer cursor
for scrollbars.

1:33 AM Changeset in webkit [196630] by Csaba Osztrogonác

2 edits in trunk/Source/WebKit2

[Mac][cmake] Unreviewed buildfix after r196488. Just for fun.

PlatformMac.cmake:

12:20 AM Changeset in webkit [196629] by Antti Koivisto

15 edits
4 adds in trunk

Optimize style invalidations for attribute selectors
https://bugs.webkit.org/show_bug.cgi?id=154242

Reviewed by Andreas Kling.

Source/WebCore:

Currently we invalidate the whole element subtree if there are any attribute selectors for the changed attribute.
This is slow as generally few if any elements are really affected. Using attribute selectors for dynamic styling
should be performant.

This patch implements optimization strategy for attributes similar to what we already have for classes:

Collect a map of all rules that contains descendant-affecting attribute selectors for a given attribute.
When an attribute value changes check if there are any such rules for it.
Check if the value change affects the results of any of the attribute selectors.
Only if it does invalidate the exact descendant elements affected by the rules.

Test: fast/css/style-invalidation-attribute-change-descendants.html

WebCore.xcodeproj/project.pbxproj:
css/DocumentRuleSets.cpp:

(WebCore::DocumentRuleSets::ancestorClassRules):
(WebCore::DocumentRuleSets::ancestorAttributeRulesForHTML):

Create optimization RuleSets when needed.

css/DocumentRuleSets.h:

(WebCore::DocumentRuleSets::uncommonAttribute):
(WebCore::DocumentRuleSets::features):

css/RuleFeature.cpp:

(WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
(WebCore::makeAttributeSelectorKey):
(WebCore::RuleFeatureSet::collectFeatures):

Collect rules with descendant affecting attribute selectors.

(WebCore::RuleFeatureSet::add):
(WebCore::RuleFeatureSet::clear):
(WebCore::RuleFeatureSet::shrinkToFit):

css/RuleFeature.h:
css/SelectorChecker.cpp:

(WebCore::anyAttributeMatches):
(WebCore::SelectorChecker::attributeSelectorMatches):

Expose function for matching single attribute selectors.

(WebCore::canMatchHoverOrActiveInQuirksMode):

css/SelectorChecker.h:
dom/Attr.cpp:

(WebCore::Attr::setValue):
(WebCore::Attr::childrenChanged):

dom/Element.cpp:

(WebCore::Element::setAttributeInternal):
(WebCore::makeIdForStyleResolution):
(WebCore::Element::attributeChanged):
(WebCore::Element::removeAttributeInternal):
(WebCore::Element::addAttributeInternal):
(WebCore::Element::removeAttribute):

Add AttributeChangeInvalidation where needed.

(WebCore::Element::needsStyleInvalidation):

Move to Element from ClassChangeInvalidation.

(WebCore::Element::willModifyAttribute):

No more full style invalidation on attribute change.

style/AttributeChangeInvalidation.cpp: Added.

(WebCore::Style::AttributeChangeInvalidation::invalidateStyle):

Invalidate local style.
Check if we need to invalidate descendants by looking into ancestorAttributeRules.

(WebCore::Style::AttributeChangeInvalidation::invalidateDescendants):

Use StyleInvalidationAnalysis to invalidate the subtree for the relevant rules.

style/AttributeChangeInvalidation.h: Added.

(WebCore::Style::AttributeChangeInvalidation::needsInvalidation):
(WebCore::Style::AttributeChangeInvalidation::AttributeChangeInvalidation):
(WebCore::Style::AttributeChangeInvalidation::~AttributeChangeInvalidation):

If needed, invalidate descendants before and after attribute change to catch rules that start and stop applying.

LayoutTests:

fast/css/style-invalidation-attribute-change-descendants-expected.txt: Added.
fast/css/style-invalidation-attribute-change-descendants.html: Added.

12:11 AM Changeset in webkit [196628] by Chris Dumez

4 edits
2 adds in trunk

Do security checks early in JSDOMWindow::put*()
https://bugs.webkit.org/show_bug.cgi?id=154270

Reviewed by Gavin Barraclough.

Source/WebCore:

Do security checks early in JSDOMWindow::put() / JSDOMWindow::putByIndex()
and return as soon as possible. This makes it less error-prone as we need
to do the security check only once, at the top of the function.

Also lock down the security further by calling lookupPut() only if the
property name is "location". The "location" property is the only one that
can be set cross-origin. Previously, trying to set a property such as
"name" (which cannot be set cross-origin) relied on the attribute setter
doing the security check when getting called. The new check is less error
prone and will correctly prevent overriding window's method cross-origin
once these move down from the prototype (Bug 154120).

Finally, the previous code was failing to set the "location" property
cross-origin after the window has been reified. This patch fixes the
issue by always calling the original "location" property setter from the
static table in the cross-origin case.

Test: http/tests/security/cross-origin-reified-window-location-setting.html

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::put):
(WebCore::JSDOMWindow::putByIndex):

LayoutTests:

http/tests/security/cross-frame-access-put-expected.txt:

Rebaseline. The extra security warnings are for the following properties:
closed, crypto, frameElement, pageXOffset and pageYOffset.
All these properties are read-only and therefore cannot be set (cross-origin
or not). The previous code was not doing an explicit check and ended up
trying to set these properties. However, since they are read-only, we would
silently fail to set them. The new code does the explicit check and therefore
will warn and NOT attempt to set.

http/tests/security/cross-origin-reified-window-location-setting-expected.txt: Added.
http/tests/security/cross-origin-reified-window-location-setting.html: Added.

Add test to check that setting window.location cross-origin still works after the
window object has been reified.

Feb 15, 2016:

11:14 PM Changeset in webkit [196627] by bshafiei@apple.com

5 edits in tags/Safari-601.5.17.1.1/Source

Versioning.

11:12 PM Changeset in webkit [196626] by bshafiei@apple.com

1 copy in tags/Safari-601.5.17.1.1

New tag.

11:10 PM Changeset in webkit [196625] by mark.lam@apple.com

14 edits in trunk/LayoutTests

[ARMv7] Some JSC test fails due to exhausting the JIT code heap on the no LLINT test configuration.
https://bugs.webkit.org/show_bug.cgi?id=151611

Reviewed by Saam Barati.

These tests are only failing because they are compiling too much with the LLINT
disabled. As a result, they are using more JIT code heap space than is allowed
by the OS.

This patch excludes these tests from the noLLINT configuration on 32-bit ARM.

js/script-tests/dfg-float32array.js:
js/script-tests/dfg-float64array.js:
js/script-tests/dfg-int16array.js:
js/script-tests/dfg-int32array-overflow-values.js:
js/script-tests/dfg-int32array.js:
js/script-tests/dfg-int8array.js:
js/script-tests/dfg-osr-entry-hoisted-clobbered-structure-check.js:
js/script-tests/dfg-uint16array.js:
js/script-tests/dfg-uint32array-overflow-values.js:
js/script-tests/dfg-uint32array.js:
js/script-tests/dfg-uint8array.js:
js/script-tests/dfg-uint8clampedarray.js:
js/script-tests/regress-141098.js:

10:42 PM Changeset in webkit [196624] by mitz@apple.com

2 edits
4 deletes in trunk/Source/WebKit2

Removed unused files after r196478.

Configurations/DatabaseProcess.xcconfig: Removed.
Configurations/NetworkProcess.xcconfig: Removed.
Configurations/PluginProcess.xcconfig: Removed.
Configurations/WebContentProcess.xcconfig: Removed.
WebKit2.xcodeproj/project.pbxproj:

9:39 PM Changeset in webkit [196623] by ChangSeok Oh

2 edits in trunk/Source/WebKit2

[ThreadedCompositor] position:fixed elements do not have their own layers when threaded compositor is enabled.
https://bugs.webkit.org/show_bug.cgi?id=154100

Reviewed by Carlos Garcia Campos.

Currently, fixed elements are redrawn to a backing store every time layout or scroll happens.
It results in the bad effect on performance-wise. Letting fixed element have separate layers is
necessary when threaded compositor is enabled at least. Because async scrolling requires it.

WebProcess/WebPage/DrawingAreaImpl.cpp:

(WebKit::DrawingAreaImpl::updatePreferences):

9:36 PM Changeset in webkit [196622] by Brent Fulgham

27 edits
8 adds in trunk

[Mac] Gather some rudimentary statistics during resource load
https://bugs.webkit.org/show_bug.cgi?id=153575
<rdar://problem/24075254>

Reviewed by Brady Eidson.

Source/WebCore:

Tested by: http/tests/navigation/statistics.html

CMakeLists.txt:
PlatformWin.cmake:
WebCore.xcodeproj/project.pbxproj:
dom/Document.cpp:

(WebCore::Document::updateLastHandledUserGestureTimestamp): Log user interaction
with the ResourceLoadObserver.

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::willSendRequest): Track load statistics if the
user interacted with the document.

loader/ResourceLoadObserver.cpp: Added.
loader/ResourceLoadObserver.h: Added.
loader/ResourceLoadStatistics.cpp: Added.
loader/ResourceLoadStatistics.h: Added.
loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::willSendRequestInternal): Track load statistics.

page/Settings.cpp:

(WebCore::Settings::setResourceLoadStatisticsEnabled): Added.

page/Settings.h:

(WebCore::Settings::resourceLoadStatisticsEnabled): Added.

platform/Logging.h:
testing/Internals.cpp:

(WebCore::Internals::resourceLoadStatisticsForOrigin):
(WebCore::Internals::setResourceLoadStatisticsEnabled):

testing/Internals.h:
testing/Internals.idl:

Source/WebKit/mac:

Misc/WebKitNSStringExtras.h:
Misc/WebKitNSStringExtras.mm:

(+[NSString _webkit_localStorageDirectoryWithBundleIdentifier:]): Added.

WebView/WebPreferenceKeysPrivate.h:
WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences resourceLoadStatisticsEnabled]): Added.
(-[WebPreferences setResourceLoadStatisticsEnabled:]): Added.

WebView/WebPreferencesPrivate.h:
WebView/WebView.mm:

(WebKitInitializeApplicationCachePathIfNecessary):
(WebKitInitializeApplicationStatisticsStoragePathIfNecessary): Added.
(-[WebView _commonInitializationWithFrameName:groupName:]): Add call to new
initialization method.
(-[WebView _preferencesChanged:]): Track changes in the user's desire to
monitor resource load statistics.
(+[WebView _applicationWillTerminate]): Write statistics to disk (if preferences
say to do so.)

Tools:

MiniBrowser/mac/SettingsController.h:
MiniBrowser/mac/SettingsController.m:

(-[SettingsController _populateMenu]): Add menu item for new debug flag.
(-[SettingsController toggleResourceLoadStatisticsEnabled:]): Added.
(-[SettingsController resourceLoadStatisticsEnabled]): Added.

MiniBrowser/mac/WK1BrowserWindowController.m:

(-[WK1BrowserWindowController didChangeSettings]): React to changes in
users's desire to track resource load statistics.

LayoutTests:

http/tests/navigation/resources/redirect-on-reload-updates-history-item-statistics.php: Added.
http/tests/navigation/resources/redirect-updates-history-item-done-statistics.html: Added.
http/tests/navigation/statistics-expected.txt: Added.
http/tests/navigation/statistics.html: Added.

9:32 PM Changeset in webkit [196621] by Chris Dumez

12 edits in trunk

The following properties should exist on the global object: AudioTrackList, AudioTrack, VideoTrackList, VideoTrack
https://bugs.webkit.org/show_bug.cgi?id=154250
<rdar://problem/24660829>

Reviewed by Eric Carlson.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

The following properties should exist on the global object:

AudioTrackList, AudioTrack, VideoTrackList, VideoTrack

These interfaces are not marked as [NoInterfaceObject] in:

https://html.spec.whatwg.org/#audiotracklist-and-videotracklist-objects

No new tests, already covered by existing tests.

html/track/AudioTrack.idl:
html/track/AudioTrackList.idl:
html/track/VideoTrack.idl:
html/track/VideoTrackList.idl:

LayoutTests:

Rebaseline now that AudioTrackList, AudioTrack, VideoTrackList and VideoTrack
are exposed on the global Window object.

js/dom/global-constructors-attributes-expected.txt:
platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt:
platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt:
platform/mac/js/dom/global-constructors-attributes-expected.txt:

9:15 PM Changeset in webkit [196620] by Nikita Vasilyev

4 edits in trunk/Source/WebInspectorUI

Web Inspector: Non-overlay scrollbars obscure the ends of lines in the console and sidebars
https://bugs.webkit.org/show_bug.cgi?id=154276

Reviewed by Timothy Hatcher.

UserInterface/Views/DataGrid.css:

(.data-grid .data-container):

UserInterface/Views/DatabaseContentView.css:

(.storage-view.query):

UserInterface/Views/LogContentView.css:

(.content-view.log):
Replace all occurrences of "overflow-y: overlay" with "overflow-y: auto".

9:11 PM Changeset in webkit [196619] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.10

Merged r196589. rdar://problem/24644805

9:11 PM Changeset in webkit [196618] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.10/Source

Versioning.

9:08 PM Changeset in webkit [196617] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.10

New tag.

8:51 PM Changeset in webkit [196616] by commit-queue@webkit.org

7 edits in trunk/Source/JavaScriptCore

[JSC] BranchAdd can override arguments of its stackmap
https://bugs.webkit.org/show_bug.cgi?id=154274

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-15
Reviewed by Filip Pizlo.

With the 3 operands BranchAdd added in r196513, we can run into
a register allocation such that the destination register is also
used by a value in the stack map.

It use to be that BranchAdd was a 2 operand instruction.
In that form, the destination is also one of the source and
can be recovered through Sub. There is no conflict between
destination and the stackmap.

After r196513, the destination has its own value. It is uncommon
on x86 because of the aggressive aliasing but that can happen.
On ARM, that's a standard form since there is no need for aliasing.

Since the arguments of the stackmap are of type EarlyUse,
they appeared as not interfering with the destination. When the register
allocator gives the same register to the destination and something in
the stack map, the result of BranchAdd destroys the value kept alive
for the stackmap.

In this patch, I introduce a concept very similar to ForceLateUse
to keep the argument of the stackmap live in CheckAdd. The new
role is "ForceLateUseUnlessRecoverable".

In this mode, anything that is not also an input argument becomes
LateUse. As such, it interferes with the destination of CheckAdd.
The arguments are recovered by the slow patch of CheckAdd. They
remain Early use.

This new modes ensure that destination can be aliased to the source
when that's useful, while making sure it is not aliased with another
value that needs to be live on exit.

b3/B3CheckSpecial.cpp:

(JSC::B3::CheckSpecial::forEachArg):

b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::lower):

b3/B3PatchpointSpecial.cpp:

(JSC::B3::PatchpointSpecial::forEachArg):

b3/B3StackmapSpecial.cpp:

(JSC::B3::StackmapSpecial::forEachArgImpl):
(WTF::printInternal):

b3/B3StackmapSpecial.h:
b3/B3StackmapValue.h:

8:41 PM Changeset in webkit [196615] by Hunseop Jeong

104 edits
4 adds in trunk/LayoutTests

[EFL] Rebaseline after r196244.

Unreviewed test gardening.

platform/efl/compositing/geometry/clipping-foreground-expected.txt:
platform/efl/compositing/geometry/root-layer-update-expected.txt:
platform/efl/compositing/overflow/ancestor-overflow-expected.txt:
platform/efl/compositing/overflow/nested-scrolling-expected.txt:
platform/efl/compositing/overflow/overflow-scroll-expected.txt:
platform/efl/compositing/overflow/parent-overflow-expected.txt:
platform/efl/compositing/overflow/scrollbar-painting-expected.txt:
platform/efl/compositing/reflections/nested-reflection-on-overflow-expected.txt:
platform/efl/compositing/sibling-positioning-expected.txt:
platform/efl/css3/unicode-bidi-isolate-basic-expected.txt:
platform/efl/fast/block/positioning/auto/vertical-rl/007-expected.txt:
platform/efl/fast/block/positioning/vertical-rl/fixed-positioning-expected.txt:
platform/efl/fast/borders/border-antialiasing-expected.txt:
platform/efl/fast/clip/001-expected.txt:
platform/efl/fast/clip/013-expected.txt:
platform/efl/fast/clip/014-expected.txt:
platform/efl/fast/clip/016-expected.txt:
platform/efl/fast/clip/outline-overflowClip-expected.txt:
platform/efl/fast/css/clip-zooming-expected.txt:
platform/efl/fast/forms/validation-message-appearance-expected.txt:
platform/efl/fast/inline/left-right-center-inline-alignment-in-ltr-and-rtl-blocks-expected.txt:
platform/efl/fast/line-grid/line-grid-inside-columns-expected.txt:
platform/efl/fast/line-grid/line-grid-into-columns-expected.txt:
platform/efl/fast/lists/scrolled-marker-paint-expected.txt:
platform/efl/fast/multicol/client-rects-expected.txt:
platform/efl/fast/multicol/column-break-with-balancing-expected.txt:
platform/efl/fast/multicol/column-rules-expected.txt:
platform/efl/fast/multicol/column-rules-stacking-expected.txt:
platform/efl/fast/multicol/columns-shorthand-parsing-expected.txt:
platform/efl/fast/multicol/float-paginate-complex-expected.txt:
platform/efl/fast/multicol/float-paginate-empty-lines-expected.txt:
platform/efl/fast/multicol/float-paginate-expected.txt:
platform/efl/fast/multicol/layers-in-multicol-expected.txt:
platform/efl/fast/multicol/layers-split-across-columns-expected.txt:
platform/efl/fast/multicol/max-height-columns-block-expected.txt:
platform/efl/fast/multicol/nested-columns-expected.txt:
platform/efl/fast/multicol/newmulticol/client-rects-expected.txt:
platform/efl/fast/multicol/overflow-across-columns-expected.txt:
platform/efl/fast/multicol/overflow-across-columns-percent-height-expected.txt:
platform/efl/fast/multicol/overflow-unsplittable-expected.txt:
platform/efl/fast/multicol/paginate-block-replaced-expected.txt:
platform/efl/fast/multicol/pagination/BottomToTop-bt-expected.txt:
platform/efl/fast/multicol/pagination/BottomToTop-lr-expected.txt:
platform/efl/fast/multicol/pagination/BottomToTop-rl-expected.txt:
platform/efl/fast/multicol/pagination/BottomToTop-tb-expected.txt:
platform/efl/fast/multicol/pagination/LeftToRight-bt-expected.txt:
platform/efl/fast/multicol/pagination/LeftToRight-rl-expected.txt:
platform/efl/fast/multicol/pagination/LeftToRight-tb-expected.txt:
platform/efl/fast/multicol/pagination/LeftToRight-tb-hittest-expected.txt:
platform/efl/fast/multicol/pagination/RightToLeft-bt-expected.txt:
platform/efl/fast/multicol/pagination/RightToLeft-lr-expected.txt:
platform/efl/fast/multicol/pagination/RightToLeft-rl-dynamic-expected.txt:
platform/efl/fast/multicol/pagination/RightToLeft-rl-expected.txt:
platform/efl/fast/multicol/pagination/RightToLeft-rl-hittest-expected.txt:
platform/efl/fast/multicol/pagination/RightToLeft-tb-expected.txt:
platform/efl/fast/multicol/pagination/TopToBottom-bt-expected.txt:
platform/efl/fast/multicol/pagination/TopToBottom-lr-expected.txt:
platform/efl/fast/multicol/pagination/TopToBottom-rl-expected.txt:
platform/efl/fast/multicol/positive-leading-expected.txt:
platform/efl/fast/multicol/scrolling-column-rules-expected.txt:
platform/efl/fast/multicol/scrolling-overflow-expected.txt:
platform/efl/fast/multicol/span/span-as-immediate-child-complex-splitting-expected.txt:
platform/efl/fast/multicol/span/span-as-immediate-child-generated-content-expected.txt:
platform/efl/fast/multicol/span/span-as-immediate-child-property-removal-expected.txt:
platform/efl/fast/multicol/span/span-as-immediate-columns-child-dynamic-expected.txt:
platform/efl/fast/multicol/span/span-as-immediate-columns-child-expected.txt:
platform/efl/fast/multicol/span/span-as-immediate-columns-child-removal-expected.txt:
platform/efl/fast/multicol/span/span-as-nested-columns-child-dynamic-expected.txt:
platform/efl/fast/multicol/span/span-as-nested-columns-child-expected.txt:
platform/efl/fast/multicol/span/span-margin-collapsing-expected.txt:
platform/efl/fast/multicol/table-vertical-align-expected.txt:
platform/efl/fast/multicol/tall-image-behavior-expected.txt:
platform/efl/fast/multicol/vertical-lr/column-break-with-balancing-expected.txt:
platform/efl/fast/multicol/vertical-lr/column-rules-expected.txt:
platform/efl/fast/multicol/vertical-lr/float-multicol-expected.txt:
platform/efl/fast/multicol/vertical-lr/float-paginate-complex-expected.txt:
platform/efl/fast/multicol/vertical-lr/float-paginate-expected.txt:
platform/efl/fast/multicol/vertical-lr/nested-columns-expected.txt:
platform/efl/fast/multicol/vertical-rl/column-break-with-balancing-expected.txt:
platform/efl/fast/multicol/vertical-rl/column-rules-expected.txt:
platform/efl/fast/multicol/vertical-rl/float-multicol-expected.txt:
platform/efl/fast/multicol/vertical-rl/float-paginate-complex-expected.txt:
platform/efl/fast/multicol/vertical-rl/float-paginate-expected.txt:
platform/efl/fast/multicol/vertical-rl/nested-columns-expected.txt:
platform/efl/fast/overflow/clip-rects-fixed-ancestor-expected.txt:
platform/efl/fast/overflow/float-in-relpositioned-expected.txt:
platform/efl/fast/overflow/overflow-auto-position-absolute-expected.txt:
platform/efl/fast/overflow/overflow-rtl-expected.txt:
platform/efl/fast/overflow/paged-x-div-expected.txt:
platform/efl/fast/overflow/paged-x-div-with-column-gap-expected.txt:
platform/efl/fast/overflow/paged-x-on-root-expected.txt:
platform/efl/fast/overflow/paged-x-with-column-gap-expected.txt:
platform/efl/fast/overflow/paged-y-div-expected.txt:
platform/efl/fast/overflow/scroll-nested-positioned-layer-in-overflow-expected.txt:
platform/efl/fast/regions/repaint/region-painting-via-layout-expected.txt:
platform/efl/fast/repaint/box-shadow-h-expected.txt:
platform/efl/fast/repaint/box-shadow-v-expected.txt:
platform/efl/fast/repaint/layer-outline-expected.txt:
platform/efl/fast/repaint/layer-outline-horizontal-expected.txt:
platform/efl/fast/table/edge-offsets-expected.txt:
platform/efl/fast/transforms/overflow-with-transform-expected.txt:
platform/efl/fast/transforms/rotated-transform-affects-scrolling-1-expected.txt: Added.
platform/efl/fast/transforms/rotated-transform-affects-scrolling-2-expected.txt: Added.
platform/efl/printing/single-line-must-not-be-split-into-two-pages-expected.txt:
platform/efl/scrollbars/scrollbars-on-positioned-content-expected.txt:
platform/efl/svg/custom/getscreenctm-in-scrollable-div-area-nested-expected.txt: Added.
platform/efl/svg/custom/image-rescale-clip-expected.txt: Added.

8:07 PM Changeset in webkit [196614] by weinig@apple.com

6 edits
1 delete in trunk/Source/WebCore

Stop using NSMapTable in places where we were only using it to be GC safe
<rdar://problem/24063723>
https://bugs.webkit.org/show_bug.cgi?id=154264

Reviewed by Dan Bernstein.

Switch from NSMapTable to HashMap.

WebCore.xcodeproj/project.pbxproj:
bindings/objc/DOMInternal.h:
bindings/objc/DOMInternal.mm:
bindings/objc/WebScriptObject.mm:
bridge/objc/objc_instance.mm:
platform/spi/cocoa/NSPointerFunctionsSPI.h: Removed. No longer used.

6:32 PM Changeset in webkit [196613] by commit-queue@webkit.org

2 edits in trunk

Re-enable INTL on WinCairo
https://bugs.webkit.org/show_bug.cgi?id=154256

Patch by Alex Christensen <achristensen@webkit.org> on 2016-02-15
Reviewed by Michael Catanzaro.

Source/cmake/OptionsWin.cmake:

Peavo updated icu and it works, so let's re-enable INTL on WinCairo to catch Windows build failures.

6:22 PM Changeset in webkit [196612] by bshafiei@apple.com

5 edits in branches/safari-601.1.46-branch/Source

Versioning.

5:53 PM Changeset in webkit [196611] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196607

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

4:50 PM Changeset in webkit [196610] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Visual sidebar minor regression fixes
https://bugs.webkit.org/show_bug.cgi?id=154237
<rdar://problem/24653135>

Patch by Devin Rousso <Devin Rousso> on 2016-02-15
Reviewed by Timothy Hatcher.

UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.css:

(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-special-property-placeholder):
Do not display the placeholder, as it is not used in comma separated value
property editors.

UserInterface/Views/VisualStyleDetailsPanel.js:

(WebInspector.VisualStyleDetailsPanel.prototype.widthDidChange):
Recalculates the width for all comma separated value elements (r196266).

(WebInspector.VisualStyleDetailsPanel.prototype._updateSections):
Only open/close sections with properties that have values when a new node
or selector item is selected.

(WebInspector.VisualStyleDetailsPanel.prototype._populateBorderSection):
Make copies of the default unit lists to prevent modifying the values used
later in other sections (r194728).

4:20 PM Changeset in webkit [196609] by achristensen@apple.com

4 edits in trunk/Source/WebKit2

Implement content sniffing check with NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154261

Reviewed by Andy Estes.

This fixes http/tests/xmlhttprequest/small-chunks-response-text.html when using NetworkSession.

NetworkProcess/NetworkDataTask.h:

(WebKit::NetworkDataTask::create):

NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad):

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTask::NetworkDataTask):
Content sniffing is enabled by default. Disable it if the NetworkLoadParameters say not to.
This is analogous to behavior in ResourceHandle::createNSURLConnection.

4:17 PM Changeset in webkit [196608] by bshafiei@apple.com

1 copy in tags/Safari-601.1.46.100

New tag.

3:58 PM Changeset in webkit [196607] by Chris Dumez

3 edits in trunk/LayoutTests/imported/w3c

Re-sync W3C web-platform-tests' html/dom/interfaces.html
https://bugs.webkit.org/show_bug.cgi?id=154259

Reviewed by Ryosuke Niwa.

Re-sync W3C web-platform-tests' html/dom/interfaces.html after:

https://github.com/w3c/web-platform-tests/pull/2580

web-platform-tests/html/dom/interfaces-expected.txt:
web-platform-tests/html/dom/interfaces.html:

3:57 PM Changeset in webkit [196606] by Matt Baker

9 edits
2 deletes in trunk/Source/WebInspectorUI

Web Inspector: eliminate the linear and rendering frames TimelineOverview subclasses
https://bugs.webkit.org/show_bug.cgi?id=154000
<rdar://problem/24553105>

Reviewed by Timothy Hatcher.

This patch eliminates the TimelineOverview subclasses, and moves logic for switching between
a time-based or frame-based graph into the overview itself. The values of the overview's start
time, current time, and end time now match the values in the timeline recording regardless of the
current view mode. When viewing the rendering frames graph, the recording times are ignored and
all frames are included. The overview maintains separate zoom level and ruler selection settings
for each view mode.

UserInterface/Main.html:
UserInterface/Views/LinearTimelineOverview.js: Removed.
UserInterface/Views/RenderingFrameTimelineOverview.js: Removed.

Removed TimelineOverview subclasses.

UserInterface/Views/RenderingFrameTimelineOverviewGraph.js:

(WebInspector.RenderingFrameTimelineOverviewGraph.prototype.get height):
Set FPS graph height to 108 pixels.

UserInterface/Views/TimelineOverview.css:

(.timeline-overview:not(.frames) > .graphs-container > .timeline-overview-graph:nth-child(even)):
(.timeline-overview:not(.frames) > .graphs-container > .timeline-overview-graph:not(:first-child)):
(.timeline-overview > .graphs-container > .timeline-overview-graph:nth-child(even)): Deleted.
(.timeline-overview > .graphs-container > .timeline-overview-graph:not(:first-child)): Deleted.
Disable alternating graph styles when showing FPS instrument.

UserInterface/Views/TimelineOverview.js:

(WebInspector.TimelineOverview):
Create separate settings for timelines and FPS view modes.
(WebInspector.TimelineOverview.prototype.get viewMode):
(WebInspector.TimelineOverview.prototype.set viewMode):
(WebInspector.TimelineOverview.prototype.set startTime):
Adjust the current ruler selection when start time changes. Not necessary
when showing the FPS instrument, which doesn't have a start time.
(WebInspector.TimelineOverview.prototype.get secondsPerPixel):
(WebInspector.TimelineOverview.prototype.set secondsPerPixel):
Now a wrapper around the corresponding view mode setting.
(WebInspector.TimelineOverview.prototype.set pixelAlignDuration):
(WebInspector.TimelineOverview.prototype.get scrollStartTime):
(WebInspector.TimelineOverview.prototype.set scrollStartTime):
Now a wrapper around the corresponding view mode setting.
(WebInspector.TimelineOverview.prototype.get visibleDuration):
(WebInspector.TimelineOverview.prototype.get height):
Return the sum height of all visible overview graphs.
(WebInspector.TimelineOverview.prototype.shown):
Show overview graphs for the current view mode.
(WebInspector.TimelineOverview.prototype.hidden):
(WebInspector.TimelineOverview.prototype.reset):
(WebInspector.TimelineOverview.prototype.recordWasFiltered):
(WebInspector.TimelineOverview.prototype.selectRecord):
(WebInspector.TimelineOverview.prototype.updateLayoutIfNeeded):
(WebInspector.TimelineOverview.prototype.layout):
Layout for both view modes is largely identical, and differs only in the treatment
of the overview's start time, current time, and end time. Time-based instruments
use time values from the recording, while the FPS instrument has a fixed start time
of zero, and a current and end time pinned to the last rendering frame.
(WebInspector.TimelineOverview.prototype._handleScrollEvent):
(WebInspector.TimelineOverview.prototype._handleWheelEvent):
(WebInspector.TimelineOverview._handleGestureStart):
(WebInspector.TimelineOverview.prototype._handleGestureChange):
(WebInspector.TimelineOverview.prototype._instrumentAdded):
(WebInspector.TimelineOverview.prototype._instrumentRemoved):
(WebInspector.TimelineOverview.prototype._timelineRulerMouseClicked):
(WebInspector.TimelineOverview.prototype._timeRangeSelectionChanged):
Save the selection for the current view mode.
(WebInspector.TimelineOverview.prototype._recordSelected):
(WebInspector.TimelineOverview.prototype._resetSelection.reset):
(WebInspector.TimelineOverview.prototype._resetSelection):
(WebInspector.TimelineOverview.prototype._canShowTimelineType):
(WebInspector.TimelineOverview.prototype._viewModeDidChange):
Sets zoom level, ruler selection, and graph visibility based on current view mode.
(WebInspector.TimelineOverview.prototype._createViewModeSettings):
Helper function for creating an object to track the zoom level and ruler
selection of each view mode.
(WebInspector.TimelineOverview.prototype.get _currentSettings):
Internal getter for retrieving the settings for the current view mode.
(WebInspector.TimelineOverview.prototype.canShowTimeline): Deleted.
Not needed now that the overview contains all timelines.

UserInterface/Views/TimelineOverviewGraph.js:

(WebInspector.TimelineOverviewGraph):
(WebInspector.TimelineOverviewGraph.prototype.shown):
(WebInspector.TimelineOverviewGraph.prototype.hidden):
Toggle CSS hidden class.

UserInterface/Views/TimelineRecordFrame.js:

No need to query offsetHeight now that TimelineOverviewGraph has a height property.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView):
Create a single timeline overview.
(WebInspector.TimelineRecordingContentView.prototype.get timelineOverviewHeight):
(WebInspector.TimelineRecordingContentView.prototype.shown):
(WebInspector.TimelineRecordingContentView.prototype.hidden):
(WebInspector.TimelineRecordingContentView.prototype.recordWasFiltered):
(WebInspector.TimelineRecordingContentView.prototype._currentContentViewDidChange):
Update the timeline overview's mode based on the current timeline view.
(WebInspector.TimelineRecordingContentView.prototype._contentViewSelectionPathComponentDidChange):
(WebInspector.TimelineRecordingContentView.prototype._updateTimes):
Removed special handling for the FPS overview.
Removed selection start time adjustment, which is now handled internally by TimelineOverview.
(WebInspector.TimelineRecordingContentView.prototype._updateTimelineOverviewHeight):
(WebInspector.TimelineRecordingContentView.prototype._recordingReset):
(WebInspector.TimelineRecordingContentView.prototype._timeRangeSelectionChanged):
(WebInspector.TimelineRecordingContentView.prototype._updateFrameSelection):

UserInterface/Views/TimelineSidebarPanel.js:

(WebInspector.TimelineSidebarPanel):
(WebInspector.TimelineSidebarPanel.prototype.matchTreeElementAgainstCustomFilters):
(WebInspector.TimelineSidebarPanel.prototype.saveStateToCookie):
(WebInspector.TimelineSidebarPanel.prototype._renderingFrameTimelineTimesUpdated):
(WebInspector.TimelineSidebarPanel.prototype._contentBrowserCurrentContentViewDidChange):
Refresh the view mode when the content view changes.
(WebInspector.TimelineSidebarPanel.prototype._recordingSelected):
(WebInspector.TimelineSidebarPanel.prototype._viewModeSelected):
(WebInspector.TimelineSidebarPanel.prototype._viewModeForTimeline):
(WebInspector.TimelineSidebarPanel.prototype._updateViewModeIfNeeded):
Sync the tree outline, frames chart, and navigation bar with the current view mode.
(WebInspector.TimelineSidebarPanel.prototype.shown):
Refreshing the frame selection is unnecessary. It's updated by the recording content
view whenever the ruler selection changes.
(WebInspector.TimelineSidebarPanel.prototype.get viewMode): Deleted.
No longer public, since the timeline overview now owns the view mode. Internally the sidebar
still tracks the current state so it can determine when the value has changed.
(WebInspector.TimelineSidebarPanel.prototype.showTimelineOverview):
(WebInspector.TimelineSidebarPanel.prototype.showTimelineViewForTimeline):
The sidebar should only be synced to the overview after the content view has changed.
(WebInspector.TimelineSidebarPanel.prototype.updateFrameSelection):
Removed unnecessary assertion.
(WebInspector.TimelineSidebarPanel.prototype._changeViewMode): Deleted.
Replaced by _updateViewModeIfNeeded.

3:57 PM Changeset in webkit [196605] by rniwa@webkit.org

5 edits
1 move
1 add
2 deletes in trunk/Websites/perf.webkit.org

v1 UI and v2 UI should share statistics.js
https://bugs.webkit.org/show_bug.cgi?id=154262

Reviewed by Chris Dumez.

Share statistics.js between v1 and v2 UI.

public/index.html:
public/js/shared.js: Deleted.
public/js/statistics.js: Removed.
public/shared: Added.
public/shared/statistics.js: Moved from Websites/perf.webkit.org/public/v2/js/statistics.js.
public/v2/index.html:
public/v2/js/statistics.js: Removed.
public/v3/index.html:
tools/detect-changes.js:

3:39 PM Changeset in webkit [196604] by mmaxfield@apple.com

24 edits
2 copies
2 adds in trunk

[Font Loading] Implement FontFace JavaScript object
https://bugs.webkit.org/show_bug.cgi?id=153345

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/text/font-face-javascript.html

This patch implements the FontFace Javascript object. This object mostly consists of
style getters / setters, which we implement by parsing input strings and generating
output strings similarly to getComputedStyle(). This object also has a load() function
which returns a promise which will be fulfilled or rejected depending on the load.
There is also a "loaded" attribute which exposes this promise directly. Also, a status
field is exposed so script knows what the state of the load is.

Currently, loading depends on our CachedResourceLoader which is part of the Document,
so this API is not available in a non-document context.

Another caveat is that immediate-mode font loading (where the content provides an
ArrayBuffer containing the bytes of the font file) is forthcoming. This requires
changing the relationship between CSSFontFaceSource and CachedFont.

CSSFontFace has been modified to keep a strong reference to the CSSFontSelector. This
is because the lifetime of the CSSFontFace can now outlive the CSSFontSelector. When
the CSSFontSelector is removed from the Document, it explicitly clears its constituent
CSSFontFaces, thereby breaking the reference cycle.

Test: fast/text/font-face-javascript-expected.html

CMakeLists.txt: Add new files.
DerivedSources.cpp: Ditto.
DerivedSources.make: Ditto.
WebCore.vcxproj/WebCore.vcxproj: Ditto.
WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
WebCore.xcodeproj/project.pbxproj: Ditto.
bindings/js/JSDOMPromise.cpp:

(WebCore::DeferredWrapper::globalObject): Remove whitespace.
(WebCore::DeferredWrapper::deferred): Allow access to the inner JSC object.

bindings/js/JSDOMPromise.h:

(WebCore::DOMPromise::deferred): Ditto.

bindings/js/JSFontFaceCustom.cpp: Copied from Source/WebCore/bindings/js/JSDOMPromise.cpp.

(WebCore::JSFontFace::loaded):
(WebCore::JSFontFace::load):

css/CSSFontFace.cpp:

(WebCore::CSSFontFace::CSSFontFace):
(WebCore::CSSFontFace::adoptSource):
(WebCore::CSSFontFace::updateStatus): Enforce the state machine's transitions.
(WebCore::CSSFontFace::fontLoaded):
(WebCore::CSSFontFace::pump):
(WebCore::CSSFontFace::load):

css/CSSFontFace.h:

(WebCore::CSSFontFaceClient::~CSSFontFaceClient):
(WebCore::CSSFontFace::create):
(WebCore::CSSFontFace::status):

css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::appendSources): Update for new CSSFontFace API.
(WebCore::CSSFontSelector::registerLocalFontFacesForFamily): Ditto.
(WebCore::CSSFontSelector::addFontFaceRule): Ditto.
(WebCore::CSSFontSelector::kick): Ditto.
(WebCore::appendSources): Deleted.
(WebCore::registerLocalFontFacesForFamily): Deleted.

css/CSSFontSelector.h:
css/CSSUnicodeRangeValue.cpp: Use for serializing the "unicodeRange" property.
css/FontFace.cpp:

(WebCore::createPromise): Implement the remaining Javascript API functions.
(WebCore::valueFromDictionary):
(WebCore::FontFace::create):
(WebCore::FontFace::FontFace):
(WebCore::FontFace::parseString):
(WebCore::FontFace::status):
(WebCore::FontFace::kick):
(WebCore::FontFace::load):
(WebCore::FontFace::fulfillPromise):
(WebCore::FontFace::rejectPromise):
(WebCore::parseString): Deleted.

css/FontFace.h:

(WebCore::FontFace::promise):
(WebCore::FontFace::backing):
(WebCore::FontFace::create): Deleted.

css/FontFace.idl: Copied from Source/WebCore/bindings/js/JSDOMPromise.cpp.

LayoutTests:

fast/text/font-face-javascript-expected.txt: Added.
fast/text/font-face-javascript.html: Added.
js/dom/global-constructors-attributes-expected.txt:
platform/efl/js/dom/global-constructors-attributes-expected.txt:
platform/gtk/js/dom/global-constructors-attributes-expected.txt:
platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt:
platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt:
platform/mac/js/dom/global-constructors-attributes-expected.txt:
platform/win/js/dom/global-constructors-attributes-expected.txt:

2:37 PM Changeset in webkit [196603] by jer.noble@apple.com

61 edits in trunk/Source/WebCore

Null-deref crash in DefaultAudioDestinationNode::suspend()
https://bugs.webkit.org/show_bug.cgi?id=154248

Reviewed by Alex Christensen.

Drive-by fix: AudioContext should be a reference, not a pointer.

Modules/webaudio/AnalyserNode.cpp:

(WebCore::AnalyserNode::AnalyserNode):

Modules/webaudio/AnalyserNode.h:

(WebCore::AnalyserNode::create):

Modules/webaudio/AudioBasicInspectorNode.cpp:

(WebCore::AudioBasicInspectorNode::AudioBasicInspectorNode):
(WebCore::AudioBasicInspectorNode::connect):
(WebCore::AudioBasicInspectorNode::disconnect):
(WebCore::AudioBasicInspectorNode::checkNumberOfChannelsForInput):
(WebCore::AudioBasicInspectorNode::updatePullStatus):

Modules/webaudio/AudioBasicInspectorNode.h:
Modules/webaudio/AudioBasicProcessorNode.cpp:

(WebCore::AudioBasicProcessorNode::AudioBasicProcessorNode):
(WebCore::AudioBasicProcessorNode::checkNumberOfChannelsForInput):

Modules/webaudio/AudioBasicProcessorNode.h:
Modules/webaudio/AudioBufferSourceNode.cpp:

(WebCore::AudioBufferSourceNode::create):
(WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
(WebCore::AudioBufferSourceNode::renderFromBuffer):
(WebCore::AudioBufferSourceNode::setBuffer):
(WebCore::AudioBufferSourceNode::startPlaying):
(WebCore::AudioBufferSourceNode::looping):
(WebCore::AudioBufferSourceNode::setLooping):

Modules/webaudio/AudioBufferSourceNode.h:
Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::AudioContext):
(WebCore::AudioContext::createBufferSource):
(WebCore::AudioContext::createMediaElementSource):
(WebCore::AudioContext::createMediaStreamDestination):
(WebCore::AudioContext::createScriptProcessor):
(WebCore::AudioContext::createBiquadFilter):
(WebCore::AudioContext::createWaveShaper):
(WebCore::AudioContext::createPanner):
(WebCore::AudioContext::createConvolver):
(WebCore::AudioContext::createDynamicsCompressor):
(WebCore::AudioContext::createAnalyser):
(WebCore::AudioContext::createGain):
(WebCore::AudioContext::createDelay):
(WebCore::AudioContext::createChannelSplitter):
(WebCore::AudioContext::createChannelMerger):
(WebCore::AudioContext::createOscillator):

Modules/webaudio/AudioContext.h:

(WebCore::operator==):
(WebCore::operator!=):

Modules/webaudio/AudioDestinationNode.cpp:

(WebCore::AudioDestinationNode::AudioDestinationNode):
(WebCore::AudioDestinationNode::render):
(WebCore::AudioDestinationNode::updateIsEffectivelyPlayingAudio):

Modules/webaudio/AudioDestinationNode.h:
Modules/webaudio/AudioNode.cpp:

(WebCore::AudioNode::AudioNode):
(WebCore::AudioNode::connect):
(WebCore::AudioNode::disconnect):
(WebCore::AudioNode::setChannelCount):
(WebCore::AudioNode::setChannelCountMode):
(WebCore::AudioNode::setChannelInterpretation):
(WebCore::AudioNode::scriptExecutionContext):
(WebCore::AudioNode::processIfNecessary):
(WebCore::AudioNode::checkNumberOfChannelsForInput):
(WebCore::AudioNode::propagatesSilence):
(WebCore::AudioNode::pullInputs):
(WebCore::AudioNode::enableOutputsIfNecessary):
(WebCore::AudioNode::deref):
(WebCore::AudioNode::finishDeref):

Modules/webaudio/AudioNode.h:

(WebCore::AudioNode::context):

Modules/webaudio/AudioNodeInput.cpp:

(WebCore::AudioNodeInput::connect):
(WebCore::AudioNodeInput::disconnect):
(WebCore::AudioNodeInput::disable):
(WebCore::AudioNodeInput::enable):
(WebCore::AudioNodeInput::updateInternalBus):
(WebCore::AudioNodeInput::bus):
(WebCore::AudioNodeInput::internalSummingBus):
(WebCore::AudioNodeInput::sumAllConnections):
(WebCore::AudioNodeInput::pull):

Modules/webaudio/AudioNodeOutput.cpp:

(WebCore::AudioNodeOutput::setNumberOfChannels):
(WebCore::AudioNodeOutput::updateNumberOfChannels):
(WebCore::AudioNodeOutput::propagateChannelCount):
(WebCore::AudioNodeOutput::pull):
(WebCore::AudioNodeOutput::bus):
(WebCore::AudioNodeOutput::fanOutCount):
(WebCore::AudioNodeOutput::paramFanOutCount):
(WebCore::AudioNodeOutput::addInput):
(WebCore::AudioNodeOutput::removeInput):
(WebCore::AudioNodeOutput::disconnectAllInputs):
(WebCore::AudioNodeOutput::addParam):
(WebCore::AudioNodeOutput::removeParam):
(WebCore::AudioNodeOutput::disconnectAllParams):
(WebCore::AudioNodeOutput::disable):
(WebCore::AudioNodeOutput::enable):

Modules/webaudio/AudioNodeOutput.h:

(WebCore::AudioNodeOutput::context):

Modules/webaudio/AudioParam.cpp:

(WebCore::AudioParam::value):
(WebCore::AudioParam::smooth):
(WebCore::AudioParam::calculateSampleAccurateValues):
(WebCore::AudioParam::calculateFinalValues):
(WebCore::AudioParam::calculateTimelineValues):
(WebCore::AudioParam::connect):
(WebCore::AudioParam::disconnect):

Modules/webaudio/AudioParam.h:

(WebCore::AudioParam::create):
(WebCore::AudioParam::AudioParam):

Modules/webaudio/AudioParamTimeline.cpp:

(WebCore::AudioParamTimeline::valueForContextTime):

Modules/webaudio/AudioParamTimeline.h:
Modules/webaudio/AudioScheduledSourceNode.cpp:

(WebCore::AudioScheduledSourceNode::AudioScheduledSourceNode):
(WebCore::AudioScheduledSourceNode::updateSchedulingInfo):
(WebCore::AudioScheduledSourceNode::start):
(WebCore::AudioScheduledSourceNode::finish):

Modules/webaudio/AudioScheduledSourceNode.h:
Modules/webaudio/AudioSummingJunction.cpp:

(WebCore::AudioSummingJunction::AudioSummingJunction):
(WebCore::AudioSummingJunction::~AudioSummingJunction):
(WebCore::AudioSummingJunction::changedOutputs):
(WebCore::AudioSummingJunction::updateRenderingState):

Modules/webaudio/AudioSummingJunction.h:

(WebCore::AudioSummingJunction::context):

Modules/webaudio/BiquadFilterNode.cpp:

(WebCore::BiquadFilterNode::BiquadFilterNode):

Modules/webaudio/BiquadFilterNode.h:

(WebCore::BiquadFilterNode::create):

Modules/webaudio/BiquadProcessor.cpp:

(WebCore::BiquadProcessor::BiquadProcessor):

Modules/webaudio/BiquadProcessor.h:
Modules/webaudio/ChannelMergerNode.cpp:

(WebCore::ChannelMergerNode::create):
(WebCore::ChannelMergerNode::ChannelMergerNode):
(WebCore::ChannelMergerNode::checkNumberOfChannelsForInput):

Modules/webaudio/ChannelMergerNode.h:
Modules/webaudio/ChannelSplitterNode.cpp:

(WebCore::ChannelSplitterNode::create):
(WebCore::ChannelSplitterNode::ChannelSplitterNode):

Modules/webaudio/ChannelSplitterNode.h:
Modules/webaudio/ConvolverNode.cpp:

(WebCore::ConvolverNode::ConvolverNode):
(WebCore::ConvolverNode::setBuffer):

Modules/webaudio/ConvolverNode.h:

(WebCore::ConvolverNode::create):

Modules/webaudio/DefaultAudioDestinationNode.cpp:

(WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
(WebCore::DefaultAudioDestinationNode::resume):
(WebCore::DefaultAudioDestinationNode::suspend):
(WebCore::DefaultAudioDestinationNode::close):

Modules/webaudio/DefaultAudioDestinationNode.h:

(WebCore::DefaultAudioDestinationNode::create):

Modules/webaudio/DelayNode.cpp:

(WebCore::DelayNode::DelayNode):

Modules/webaudio/DelayNode.h:

(WebCore::DelayNode::create):

Modules/webaudio/DelayProcessor.cpp:

(WebCore::DelayProcessor::DelayProcessor):

Modules/webaudio/DelayProcessor.h:
Modules/webaudio/DynamicsCompressorNode.cpp:

(WebCore::DynamicsCompressorNode::DynamicsCompressorNode):

Modules/webaudio/DynamicsCompressorNode.h:

(WebCore::DynamicsCompressorNode::create):

Modules/webaudio/GainNode.cpp:

(WebCore::GainNode::GainNode):
(WebCore::GainNode::checkNumberOfChannelsForInput):

Modules/webaudio/GainNode.h:

(WebCore::GainNode::create):

Modules/webaudio/MediaElementAudioSourceNode.cpp:

(WebCore::MediaElementAudioSourceNode::create):
(WebCore::MediaElementAudioSourceNode::MediaElementAudioSourceNode):
(WebCore::MediaElementAudioSourceNode::setFormat):

Modules/webaudio/MediaElementAudioSourceNode.h:
Modules/webaudio/MediaStreamAudioDestinationNode.cpp:

(WebCore::MediaStreamAudioDestinationNode::create):
(WebCore::MediaStreamAudioDestinationNode::MediaStreamAudioDestinationNode):

Modules/webaudio/MediaStreamAudioDestinationNode.h:
Modules/webaudio/MediaStreamAudioSourceNode.cpp:

(WebCore::MediaStreamAudioSourceNode::MediaStreamAudioSourceNode):
(WebCore::MediaStreamAudioSourceNode::setFormat):

Modules/webaudio/OfflineAudioDestinationNode.cpp:

(WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
(WebCore::OfflineAudioDestinationNode::offlineRender):
(WebCore::OfflineAudioDestinationNode::notifyComplete):

Modules/webaudio/OfflineAudioDestinationNode.h:

(WebCore::OfflineAudioDestinationNode::create):

Modules/webaudio/OscillatorNode.cpp:

(WebCore::OscillatorNode::create):
(WebCore::OscillatorNode::OscillatorNode):

Modules/webaudio/OscillatorNode.h:
Modules/webaudio/PannerNode.cpp:

(WebCore::PannerNode::PannerNode):
(WebCore::PannerNode::pullInputs):
(WebCore::PannerNode::process):
(WebCore::PannerNode::listener):
(WebCore::PannerNode::setPanningModel):

Modules/webaudio/PannerNode.h:

(WebCore::PannerNode::create):

Modules/webaudio/ScriptProcessorNode.cpp:

(WebCore::ScriptProcessorNode::create):
(WebCore::ScriptProcessorNode::ScriptProcessorNode):
(WebCore::ScriptProcessorNode::initialize):
(WebCore::ScriptProcessorNode::fireProcessEvent):

Modules/webaudio/ScriptProcessorNode.h:
Modules/webaudio/WaveShaperNode.cpp:

(WebCore::WaveShaperNode::WaveShaperNode):
(WebCore::WaveShaperNode::setOversample):

Modules/webaudio/WaveShaperNode.h:

(WebCore::WaveShaperNode::create):

2:36 PM Changeset in webkit [196602] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

Null-deref crash in DefaultAudioDestinationNode::suspend()
https://bugs.webkit.org/show_bug.cgi?id=154248

Reviewed by Alex Christensen.

Null-check scriptExecutionContext() before deref.

Modules/webaudio/DefaultAudioDestinationNode.cpp:

(WebCore::DefaultAudioDestinationNode::resume):
(WebCore::DefaultAudioDestinationNode::suspend):
(WebCore::DefaultAudioDestinationNode::close):

2:33 PM Changeset in webkit [196601] by Csaba Osztrogonác

2 edits in trunk/Tools

[EFL] Update Tools/efl/install-dependencies
https://bugs.webkit.org/show_bug.cgi?id=154239

Reviewed by Michael Catanzaro.

efl/install-dependencies:

2:25 PM Changeset in webkit [196600] by achristensen@apple.com

11 edits
4 adds in trunk/Source/WebKit2

Move Download authentication code to AuthenticationManager
https://bugs.webkit.org/show_bug.cgi?id=154132

Reviewed by Sam Weinig.

When a video element makes a request that receives an authentication challenge, the
AuthenticationManager receives an AuthenticationChallenge without an AuthenticationClient.
As a result, Download::receivedCredential and other functions were being called, which
sent a message to the challenge's sender. This functionality is not specific to downloads,
so I moved it from Download to AuthenticationManager.

This fixes http/tests/media/video-auth.html when using NetworkSession
because I use AuthenticationManager::receivedCredential if there is no AuthenticationClient
instead of improperly asserting that there is always an AuthenticationClient if there is no
completionHandler.

NetworkProcess/Downloads/Download.h:
NetworkProcess/Downloads/ios/DownloadIOS.mm:

NetworkProcess/Downloads/mac/DownloadMac.mm:

NetworkProcess/Downloads/soup/DownloadSoup.cpp:

(WebKit::Download::platformDidFinish):
(WebKit::Download::receivedCredential): Deleted.
(WebKit::Download::receivedRequestToContinueWithoutCredential): Deleted.
(WebKit::Download::receivedCancellation): Deleted.
(WebKit::Download::continueWithoutCredential): Deleted.
(WebKit::Download::useCredential): Deleted.
(WebKit::Download::cancelAuthenticationChallenge): Deleted.
(WebKit::Download::receivedRequestToPerformDefaultHandling): Deleted.
(WebKit::Download::receivedChallengeRejection): Deleted.

PlatformEfl.cmake:
PlatformGTK.cmake:
PlatformMac.cmake:
Shared/Authentication/AuthenticationManager.cpp:

(WebKit::AuthenticationManager::didReceiveAuthenticationChallenge):
(WebKit::AuthenticationManager::useCredentialForSingleChallenge):
(WebKit::AuthenticationManager::continueWithoutCredentialForChallenge):
(WebKit::AuthenticationManager::continueWithoutCredentialForSingleChallenge):
(WebKit::AuthenticationManager::cancelChallenge):
(WebKit::AuthenticationManager::cancelSingleChallenge):
(WebKit::AuthenticationManager::performDefaultHandling):
(WebKit::AuthenticationManager::performDefaultHandlingForSingleChallenge):
(WebKit::AuthenticationManager::rejectProtectionSpaceAndContinue):
(WebKit::AuthenticationManager::rejectProtectionSpaceAndContinueForSingleChallenge):

Shared/Authentication/AuthenticationManager.h:

(WebKit::AuthenticationManager::outstandingAuthenticationChallengeCount):

Shared/Authentication/cocoa: Added.
Shared/Authentication/cocoa/AuthenticationManagerCocoa.mm: Added.

(WebKit::AuthenticationManager::receivedCredential):
(WebKit::AuthenticationManager::receivedRequestToContinueWithoutCredential):
(WebKit::AuthenticationManager::receivedCancellation):
(WebKit::AuthenticationManager::receivedRequestToPerformDefaultHandling):
(WebKit::AuthenticationManager::receivedChallengeRejection):

Shared/Authentication/soup: Added.
Shared/Authentication/soup/AuthenticationManagerSoup.cpp: Added.

WebKit2.xcodeproj/project.pbxproj:

2:03 PM Changeset in webkit [196599] by Chris Dumez

22 edits
1 copy
1 add in trunk

XMLHttpRequest / XMLHttpRequestUpload should inherit XMLHttpRequestEventTarget
https://bugs.webkit.org/show_bug.cgi?id=154230

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

web-platform-tests/XMLHttpRequest/interfaces-expected.txt:

Source/WebCore:

MLHttpRequest / XMLHttpRequestUpload should inherit XMLHttpRequestEventTarget
as per:
https://xhr.spec.whatwg.org/#xmlhttprequesteventtarget

Firefox and Chrome already match the specification.

No new tests, already covered by existing tests.

CMakeLists.txt:
DerivedSources.make:
WebCore.vcxproj/WebCore.vcxproj:
WebCore.vcxproj/WebCore.vcxproj.filters:
WebCore.xcodeproj/project.pbxproj:
xml/XMLHttpRequest.h:
xml/XMLHttpRequest.idl:
xml/XMLHttpRequestEventTarget.h: Added.
xml/XMLHttpRequestEventTarget.idl: Copied from Source/WebCore/xml/XMLHttpRequestUpload.idl.
xml/XMLHttpRequestUpload.h:
xml/XMLHttpRequestUpload.idl:

LayoutTests:

Rebaseline tests now that XMLHttpRequestEventTarget is exposed on the
global objects.

js/dom/global-constructors-attributes-dedicated-worker-expected.txt:
js/dom/global-constructors-attributes-expected.txt:
platform/efl/js/dom/global-constructors-attributes-dedicated-worker-expected.txt:
platform/efl/js/dom/global-constructors-attributes-expected.txt:
platform/gtk/js/dom/global-constructors-attributes-expected.txt:
platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt:
platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt:
platform/mac/js/dom/global-constructors-attributes-expected.txt:
platform/win/js/dom/global-constructors-attributes-expected.txt:

1:38 PM Changeset in webkit [196598] by jiewen_tan@apple.com

13 edits
2 adds in trunk

Refine SimulatedMouseEvent to support Event.isTrusted
https://bugs.webkit.org/show_bug.cgi?id=154133
<rdar://problem/24616246>

Reviewed by Darin Adler.

Source/WebCore:

This patch extracts everything related to create/dispatch SimulatedMouseEvent from MouseEvent.h/cpp
and EventDispatcher.h/cpp, and produces SimulateClick.h/cpp which will handle simulated click solely.
After that, we hide the SimulatedMouseEvent and only expose simulateClick to be called. The reason is
that we both want to tell whether the call sites are from user agent/bindings and keep the
SimulatedMouseEvent intact.

Also, this patch separate Element::dispatchSimulatedClick into two: one for the user agent, and another
for the bindings. Therefore, HTMLElement.click will be treated as untrusted.

Some of the changes in this patch referred Blink r200401:
https://codereview.chromium.org/1285793004

Modified test:
LayoutTests/imported/blink/fast/events/event-trusted.html

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
dom/Element.cpp:

(WebCore::Element::dispatchSimulatedClick):
(WebCore::Element::dispatchSimulatedClickForBindings):

dom/Element.h:
dom/EventDispatcher.cpp:

(WebCore::EventDispatcher::dispatchSimulatedClick): Deleted.

dom/EventDispatcher.h:
dom/MouseEvent.cpp:

(WebCore::SimulatedMouseEvent::create): Deleted.
(WebCore::SimulatedMouseEvent::~SimulatedMouseEvent): Deleted.
(WebCore::SimulatedMouseEvent::SimulatedMouseEvent): Deleted.

dom/MouseEvent.h:
dom/SimulatedClick.cpp: Added.

(WebCore::simulateMouseEvent):
(WebCore::simulateClick):

dom/SimulatedClick.h: Added.
html/HTMLElement.cpp:

(WebCore::HTMLElement::click):

LayoutTests:

imported/blink/fast/events/event-trusted-expected.txt:
imported/blink/fast/events/event-trusted.html:

1:37 PM Changeset in webkit [196597] by timothy@apple.com

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Show inherited CSS variables in the Style sidebar
https://bugs.webkit.org/show_bug.cgi?id=154215
rdar://problem/24644058

Reviewed by Joseph Pecoraro.

UserInterface/Models/CSSProperty.js:

(WebInspector.CSSProperty.isInheritedPropertyName): Added.
(WebInspector.CSSProperty.prototype.update): Use WebInspector.CSSProperty.isInheritedPropertyName.

UserInterface/Models/DOMNodeStyles.js:

(WebInspector.DOMNodeStyles.prototype._parseStyleDeclarationPayload): Use WebInspector.CSSProperty.isInheritedPropertyName.

1:30 PM Changeset in webkit [196596] by timothy@apple.com

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Sidebars are defaulting to their minimum width, instead of a good width
https://bugs.webkit.org/show_bug.cgi?id=154218
rdar://problem/24644192

Reviewed by Joseph Pecoraro.

UserInterface/Views/SidebarPanel.js:

(WebInspector.SidebarPanel): Default the setting value to 300 instead of 0, so the minimum isn't used.

1:25 PM Changeset in webkit [196595] by Ryan Haddad

3 edits in trunk/LayoutTests

Marking animations/animation-delay-changed.html as flaky on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=154253

Unreviewed test gardening.

platform/ios-simulator-wk2/TestExpectations:
platform/ios-simulator/TestExpectations:

1:23 PM Changeset in webkit [196594] by commit-queue@webkit.org

12 edits
5 adds in trunk

Web Inspector: Web Workers have no access to console for debugging
https://bugs.webkit.org/show_bug.cgi?id=26237

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-15
Reviewed by Timothy Hatcher.

LayoutTests/imported/w3c:

web-platform-tests/streams-api/readable-streams/garbage-collection-expected.txt:

Update test results for a console.warn message that the test produces from a Worker.

Source/JavaScriptCore:

inspector/ConsoleMessage.h:

Add accessor for MessageLevel.

Source/WebCore:

This adds the most basic console message support to Workers.
Messages logged from workers get surfaced through the Page's console.
This lacks support for logging and interacting with arguments,
which would be addressed when adding more complete Worker
debugging tools.

Test: inspector/console/messageAdded-from-worker.html

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:

Add new files.

bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::~WorkerScriptController):
(WebCore::WorkerScriptController::initScript):
Set the ConsoleClient for the Worker's global object. We route
the messages to the Page's console.

bindings/js/WorkerScriptController.h:
workers/WorkerConsoleClient.h: Added.
workers/WorkerConsoleClient.cpp: Added.

(WebCore::WorkerConsoleClient::WorkerConsoleClient):
(WebCore::WorkerConsoleClient::~WorkerConsoleClient):
(WebCore::WorkerConsoleClient::profile):
(WebCore::WorkerConsoleClient::profileEnd):
(WebCore::WorkerConsoleClient::count):
(WebCore::WorkerConsoleClient::time):
(WebCore::WorkerConsoleClient::timeEnd):
(WebCore::WorkerConsoleClient::timeStamp):
Stub most console methods in a Worker.

(WebCore::WorkerConsoleClient::messageWithTypeAndLevel):
Send worker log messages to the global scope and on to the main page.

workers/WorkerGlobalScope.h:
workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::addConsoleMessage):
(WebCore::WorkerGlobalScope::addMessageToWorkerConsole):
Ideally we want to converge on simple addConsoleMessage
APIs that just take a ConsoleMessage, without a barrage
of parameters. Add these versions now.

LayoutTests:

inspector/console/messageAdded-from-worker-expected.txt: Added.
inspector/console/messageAdded-from-worker.html: Added.
inspector/console/resources/worker-console-log.js: Added.

1:16 PM Changeset in webkit [196593] by timothy@apple.com

5 edits
2 adds in trunk

Web Inspector: CSS variables are not formatted correctly
https://bugs.webkit.org/show_bug.cgi?id=154217
rdar://problem/24644154

Reviewed by Joseph Pecoraro.

Source/WebInspectorUI:

UserInterface/Views/CodeMirrorFormatters.js:

(newlineBeforeToken): Check for variable-2 token in the maybeprop state.

LayoutTests:

inspector/codemirror/prettyprinting-css-rules-expected.txt:
inspector/codemirror/prettyprinting-css-rules.html:
inspector/codemirror/resources/prettyprinting/css-rule-tests/css-variables-expected.css: Added.
inspector/codemirror/resources/prettyprinting/css-rule-tests/css-variables.css: Added.

1:13 PM Changeset in webkit [196592] by timothy@apple.com

2 edits in trunk/Source/WebInspectorUI

Web Inspector: CodeMirror styles needs updated for CSS variables
https://bugs.webkit.org/show_bug.cgi?id=154216
rdar://problem/24644146

Reviewed by Joseph Pecoraro.

UserInterface/Views/SyntaxHighlightingDefaultTheme.css:

(.cm-s-default .cm-m-css:matches(.cm-atom, .cm-meta, .cm-variable-2, .cm-variable-3, .cm-property)): Added .cm-variable-2.
(.cm-s-default .basic-block-has-not-executed.cm-m-css:matches(.cm-atom, .cm-meta, .cm-variable-2, .cm-variable-3, .cm-property)): Ditto.

1:08 PM Changeset in webkit [196591] by mark.lam@apple.com

5 edits in trunk/Source/JavaScriptCore

[ARMv7] stress/op_rshift.js and stress/op_urshift.js are failing.
https://bugs.webkit.org/show_bug.cgi?id=151514

Reviewed by Filip Pizlo.

Meanwhile, our macro assembler is expecting the immediate shift value to be
between 0-31. As a result, a shift amount of 0 is being wrongly encoded with 0
bits which means shift right by 32 bits.

The fix is to check if the shift amount is 0, and if so, emit a move. Else,
emit the right shift as usual.

This issue does not affect left shifts, as the immediate shift amount for left
shifts is between 0-31 as our macro assembler expects.

assembler/MacroAssemblerARM.h:

(JSC::MacroAssemblerARM::rshift32):
(JSC::MacroAssemblerARM::urshift32):
(JSC::MacroAssemblerARM::sub32):

assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::rshift32):
(JSC::MacroAssemblerARMv7::urshift32):

tests/stress/op_rshift.js:
tests/stress/op_urshift.js:
Un-skip these tests. They should always pass now.

12:49 PM Changeset in webkit [196590] by achristensen@apple.com

2 edits in trunk/Source/WebCore

CMake build fix.

PlatformMac.cmake:

12:30 PM Changeset in webkit [196589] by achristensen@apple.com

5 edits in trunk

Fix internal Windows build of projects built after WebKit
https://bugs.webkit.org/show_bug.cgi?id=154249
rdar://problem/24644805

Reviewed by Chris Dumez.

Source/WebKit:

PlatformWin.cmake:

Copy all generated headers to ForwardingHeaders/WebKit, not just WebKit.h.
This should fix problems related to not finding headers from other projects, such as AccessibleApplication.h.
WebKit.h, WebKitCOMAPI.h, and CFDictionaryPropertyBag.h were copied correctly, so this should copy the rest
of the needed headers.

Tools:

DumpRenderTree/PlatformWin.cmake:
MiniBrowser/win/CMakeLists.txt:

Don't include DerivedSources/WebKit/Interfaces to make MiniBrowser and DumpRenderTree
more like projects built internally after WebKit. They should only need to use what
is in ForwardingHeaders/WebKit.

12:09 PM Changeset in webkit [196588] by Chris Dumez

3 edits
2 adds in trunk

Regression(r196563): It is no longer possible to call window.addEventListener without an explicit 'this'
https://bugs.webkit.org/show_bug.cgi?id=154245

Reviewed by Ryosuke Niwa.

Source/WebCore:

This patch adds support for calling the EventListener API without an
explicit 'this' value. If no explicit 'this' value is passed, then we
fall back to using the global object. This matches Chrome and Firefox's
behavior. It also fixes the Dromaeo/cssquery-dojo.html test.

Test: fast/dom/Window/addEventListener-implicit-this.html

bindings/scripts/CodeGeneratorJS.pm:

(GenerateFunctionCastedThis):

LayoutTests:

Add a layout test to cover the use of the EventListener API without an
explicit 'this' value.

fast/dom/Window/addEventListener-implicit-this-expected.txt: Added.
fast/dom/Window/addEventListener-implicit-this.html: Added.

12:09 PM Changeset in webkit [196587] by fpizlo@apple.com

3 edits
1 add in trunk/Source/JavaScriptCore

Parser::parseVariableDeclarationList should null check the node before attempting to create a new CommaExpr
https://bugs.webkit.org/show_bug.cgi?id=154244
rdar://problem/24290670

Reviewed by Michael Saboff.

parser/ASTBuilder.h:

(JSC::ASTBuilder::appendToCommaExpr): Catch the bug sooner in debug.

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseVariableDeclarationList): Fix the bug.

tests/stress/for-let-comma.js: Added. This used to crash in debug and release.

12:01 PM Changeset in webkit [196586] by bshafiei@apple.com

5 edits in branches/safari-601.1.46-branch/Source/bmalloc

Merged r196536. rdar://problem/24620164

11:59 AM Changeset in webkit [196585] by bshafiei@apple.com

2 edits in branches/safari-601.1.46-branch/Source/bmalloc

Merged r196424. rdar://problem/24620164

11:58 AM Changeset in webkit [196584] by bshafiei@apple.com

4 edits in branches/safari-601.1.46-branch/Source/bmalloc

Merged r196421. rdar://problem/24620164

11:56 AM Changeset in webkit [196583] by barraclough@apple.com

2 edits in trunk/Source/WebCore

Organize, deduplicate & comment JSDOMWindowCustom getOwnPropertySlot
https://bugs.webkit.org/show_bug.cgi?id=154224

Reviewed by Chris Dumez.

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
(WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):
(WebCore::JSDOMWindow::getOwnPropertySlot):
(WebCore::JSDOMWindow::getOwnPropertySlotByIndex):

organized property access sequence into a more logical order, removed duplicated code & added comments.

(WebCore::namedItemGetter): Deleted.

there was no need for a custom callback here; merged functionality into jsDOMWindowGetOwnPropertySlotNamedItemGetter.

(WebCore::jsDOMWindowGetOwnPropertySlotCrossOrigin): Deleted.

renamed to jsDOMWindowGetOwnPropertySlotRestrictedAccess (this now also handles frameless access).

10:54 AM Changeset in webkit [196582] by dbates@webkit.org

6 edits in trunk

CSP: 'sandbox' should be ignored in report-only mode
https://bugs.webkit.org/show_bug.cgi?id=153167
<rdar://problem/22708669>

Reviewed by Brent Fulgham.

Source/WebCore:

Merged from Blink (patch by Mike West):
<https://src.chromium.org/viewvc/blink?revision=165322&view=revision>

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode): Added. Logs a
console message to the console to explain that the specified directive is invalid in
report-only mode.

page/csp/ContentSecurityPolicy.h:
page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::applySandboxPolicy): Do not apply sandbox
policy when in report-only mode and call ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode()
to log a message to the console.

LayoutTests:

Remove the entry from the TestExpectations file for the test
http/tests/security/contentSecurityPolicy/sandbox-report-only.html as it now passes.

TestExpectations:

10:53 AM Changeset in webkit [196581] by dbates@webkit.org

5 edits in trunk

CSP: Allow schemeless source expressions to match an HTTP or HTTPS resource
https://bugs.webkit.org/show_bug.cgi?id=154177
<rdar://problem/22708772>

Reviewed by Brent Fulgham.

Source/WebCore:

Allow a schemeless source expression to match an HTTP or HTTPS subresource when the page is
delivered over HTTP as per section Matching Source Expressions of the Content Security Policy
2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/> (21 July 2015).

Currently we have logic that implements this functionality, but it is guarded behind the compile-
time macro ENABLE(CSP_NEXT) that is disabled by default. Instead we should always compile such
code. In subsequent commits we will move more code out from under the ENABLE(CSP_NEXT)-guard
towards removing the ENABLE_CSP_NEXT macro entirely.

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::protocolMatchesSelf):

LayoutTests:

Update test case and expected result to test that a schemeless source expression
matches an HTTPS subresource (and does not trigger a Content Security Policy violation)
when the page is served over HTTP.

http/tests/security/contentSecurityPolicy/source-list-parsing-10-expected.txt:
http/tests/security/contentSecurityPolicy/source-list-parsing-10.html: Change "no" to "yes"

so that we consider it a success (and continue printing "PASS") when we load and execute the
script, <https://127.0.0.1:8443/security/contentSecurityPolicy/resources/script.js>.

9:52 AM Changeset in webkit [196580] by timothy@apple.com

2 edits in trunk/Websites/webkit.org

Fix byline to avoid bumping into content sticks out.

wp-content/themes/webkit/style.css:

(article .byline): Bump padding to avoid content with negative margins.

9:44 AM Changeset in webkit [196579] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196563

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

7:53 AM Changeset in webkit [196578] by commit-queue@webkit.org

3 edits
1 add in trunk/Source/WebCore

[cmake] Consolidated Linux-specific file lists.
https://bugs.webkit.org/show_bug.cgi?id=154219

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-15
Reviewed by Gyuyoung Kim.

No new tests needed.

PlatformEfl.cmake: Moved Linux files and include dir to Linux.cmake.
PlatformGTK.cmake: Ditto.
platform/Linux.cmake: Added.

5:30 AM Changeset in webkit [196577] by Hunseop Jeong

344 edits in trunk/LayoutTests

Unreviewed. EFL gardening after r195740.

platform/efl/tables/mozilla/bugs/bug10269-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug10269-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug10296-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug103533-expected.txt:
platform/efl/tables/mozilla/bugs/bug106158-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug108340-expected.txt:
platform/efl/tables/mozilla/bugs/bug110566-expected.txt:
platform/efl/tables/mozilla/bugs/bug11321-expected.txt:
platform/efl/tables/mozilla/bugs/bug113235-3-expected.txt:
platform/efl/tables/mozilla/bugs/bug11944-expected.txt:
platform/efl/tables/mozilla/bugs/bug119786-expected.txt:
platform/efl/tables/mozilla/bugs/bug12384-expected.txt:
platform/efl/tables/mozilla/bugs/bug1261-expected.txt:
platform/efl/tables/mozilla/bugs/bug12910-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug13105-expected.txt:
platform/efl/tables/mozilla/bugs/bug13118-expected.txt:
platform/efl/tables/mozilla/bugs/bug133756-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug133756-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug13484-expected.txt:
platform/efl/tables/mozilla/bugs/bug13526-expected.txt:
platform/efl/tables/mozilla/bugs/bug138725-expected.txt:
platform/efl/tables/mozilla/bugs/bug14159-3-expected.txt:
platform/efl/tables/mozilla/bugs/bug149275-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug17130-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug1828-expected.txt:
platform/efl/tables/mozilla/bugs/bug18359-expected.txt:
platform/efl/tables/mozilla/bugs/bug18558-expected.txt:
platform/efl/tables/mozilla/bugs/bug2050-expected.txt:
platform/efl/tables/mozilla/bugs/bug20579-expected.txt:
platform/efl/tables/mozilla/bugs/bug21299-expected.txt:
platform/efl/tables/mozilla/bugs/bug21918-expected.txt:
platform/efl/tables/mozilla/bugs/bug221784-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug221784-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug22246-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug22246-2a-expected.txt:
platform/efl/tables/mozilla/bugs/bug2267-expected.txt:
platform/efl/tables/mozilla/bugs/bug23072-expected.txt:
platform/efl/tables/mozilla/bugs/bug23151-expected.txt:
platform/efl/tables/mozilla/bugs/bug23299-expected.txt:
platform/efl/tables/mozilla/bugs/bug24503-expected.txt:
platform/efl/tables/mozilla/bugs/bug24627-expected.txt:
platform/efl/tables/mozilla/bugs/bug2469-expected.txt:
platform/efl/tables/mozilla/bugs/bug2479-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug24880-expected.txt:
platform/efl/tables/mozilla/bugs/bug25086-expected.txt:
platform/efl/tables/mozilla/bugs/bug2516-expected.txt:
platform/efl/tables/mozilla/bugs/bug25367-expected.txt:
platform/efl/tables/mozilla/bugs/bug2585-expected.txt:
platform/efl/tables/mozilla/bugs/bug26178-expected.txt:
platform/efl/tables/mozilla/bugs/bug27038-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug27038-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug275625-expected.txt:
platform/efl/tables/mozilla/bugs/bug2757-expected.txt:
platform/efl/tables/mozilla/bugs/bug278266-expected.txt:
platform/efl/tables/mozilla/bugs/bug278385-expected.txt:
platform/efl/tables/mozilla/bugs/bug2886-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug28928-expected.txt:
platform/efl/tables/mozilla/bugs/bug29157-expected.txt:
platform/efl/tables/mozilla/bugs/bug2973-expected.txt:
platform/efl/tables/mozilla/bugs/bug3037-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug3037-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug30418-expected.txt:
platform/efl/tables/mozilla/bugs/bug30985-expected.txt:
platform/efl/tables/mozilla/bugs/bug3191-expected.txt:
platform/efl/tables/mozilla/bugs/bug32205-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug32205-5-expected.txt:
platform/efl/tables/mozilla/bugs/bug32447-expected.txt:
platform/efl/tables/mozilla/bugs/bug3263-expected.txt:
platform/efl/tables/mozilla/bugs/bug3309-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug34538-expected.txt:
platform/efl/tables/mozilla/bugs/bug35662-expected.txt:
platform/efl/tables/mozilla/bugs/bug3718-expected.txt:
platform/efl/tables/mozilla/bugs/bug39209-expected.txt:
platform/efl/tables/mozilla/bugs/bug40828-expected.txt:
platform/efl/tables/mozilla/bugs/bug4284-expected.txt:
platform/efl/tables/mozilla/bugs/bug4429-expected.txt:
platform/efl/tables/mozilla/bugs/bug44523-expected.txt:
platform/efl/tables/mozilla/bugs/bug45055-expected.txt:
platform/efl/tables/mozilla/bugs/bug4520-expected.txt:
platform/efl/tables/mozilla/bugs/bug46268-3-expected.txt:
platform/efl/tables/mozilla/bugs/bug46268-5-expected.txt:
platform/efl/tables/mozilla/bugs/bug46268-expected.txt:
platform/efl/tables/mozilla/bugs/bug46480-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug46480-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug4739-expected.txt:
platform/efl/tables/mozilla/bugs/bug48028-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug48028-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug51037-expected.txt:
platform/efl/tables/mozilla/bugs/bug51140-expected.txt:
platform/efl/tables/mozilla/bugs/bug55527-expected.txt:
platform/efl/tables/mozilla/bugs/bug55545-expected.txt:
platform/efl/tables/mozilla/bugs/bug55694-expected.txt:
platform/efl/tables/mozilla/bugs/bug56405-expected.txt:
platform/efl/tables/mozilla/bugs/bug57300-expected.txt:
platform/efl/tables/mozilla/bugs/bug57378-expected.txt:
platform/efl/tables/mozilla/bugs/bug57828-expected.txt:
platform/efl/tables/mozilla/bugs/bug5798-expected.txt:
platform/efl/tables/mozilla/bugs/bug5799-expected.txt:
platform/efl/tables/mozilla/bugs/bug5838-expected.txt:
platform/efl/tables/mozilla/bugs/bug58402-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug59354-expected.txt:
platform/efl/tables/mozilla/bugs/bug60013-expected.txt:
platform/efl/tables/mozilla/bugs/bug60749-expected.txt:
platform/efl/tables/mozilla/bugs/bug60992-expected.txt:
platform/efl/tables/mozilla/bugs/bug63785-expected.txt:
platform/efl/tables/mozilla/bugs/bug650-expected.txt:
platform/efl/tables/mozilla/bugs/bug67864-expected.txt:
platform/efl/tables/mozilla/bugs/bug67915-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug69187-expected.txt:
platform/efl/tables/mozilla/bugs/bug709-expected.txt:
platform/efl/tables/mozilla/bugs/bug7112-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug7112-2-expected.txt:
platform/efl/tables/mozilla/bugs/bug75250-expected.txt:
platform/efl/tables/mozilla/bugs/bug8032-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug82946-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug8361-expected.txt:
platform/efl/tables/mozilla/bugs/bug83786-expected.txt:
platform/efl/tables/mozilla/bugs/bug8381-expected.txt:
platform/efl/tables/mozilla/bugs/bug9072-expected.txt:
platform/efl/tables/mozilla/bugs/bug9271-1-expected.txt:
platform/efl/tables/mozilla/bugs/bug93363-expected.txt:
platform/efl/tables/mozilla/bugs/bug96343-expected.txt:
platform/efl/tables/mozilla/bugs/bug965-expected.txt:
platform/efl/tables/mozilla/bugs/bug97138-expected.txt:
platform/efl/tables/mozilla/bugs/bug99923-expected.txt:
platform/efl/tables/mozilla/bugs/bug99948-expected.txt:
platform/efl/tables/mozilla/collapsing_borders/bug127040-expected.txt:
platform/efl/tables/mozilla/collapsing_borders/bug41262-4-expected.txt:
platform/efl/tables/mozilla/core/captions-expected.txt:
platform/efl/tables/mozilla/core/col_widths_auto_auto-expected.txt:
platform/efl/tables/mozilla/core/col_widths_auto_autoPer-expected.txt:
platform/efl/tables/mozilla/core/col_widths_fix_autoPer-expected.txt:
platform/efl/tables/mozilla/core/row_span-expected.txt:
platform/efl/tables/mozilla/dom/appendCol2-expected.txt:
platform/efl/tables/mozilla/dom/appendRowsExpand1-expected.txt:
platform/efl/tables/mozilla/dom/appendTbodyExpand1-expected.txt:
platform/efl/tables/mozilla/dom/deleteCellsRebuild1-expected.txt:
platform/efl/tables/mozilla/dom/deleteCellsShrink1-expected.txt:
platform/efl/tables/mozilla/dom/deleteCellsShrink2-expected.txt:
platform/efl/tables/mozilla/dom/deleteCol1-expected.txt:
platform/efl/tables/mozilla/dom/deleteCol2-expected.txt:
platform/efl/tables/mozilla/dom/deleteCol3-expected.txt:
platform/efl/tables/mozilla/dom/deleteColGroup1-expected.txt:
platform/efl/tables/mozilla/dom/deleteColGroup2-expected.txt:
platform/efl/tables/mozilla/dom/deleteRowsRebuild1-expected.txt:
platform/efl/tables/mozilla/dom/deleteRowsShrink1-expected.txt:
platform/efl/tables/mozilla/dom/deleteTbodyExpand1-expected.txt:
platform/efl/tables/mozilla/dom/deleteTbodyRebuild1-expected.txt:
platform/efl/tables/mozilla/dom/insertCellsExpand1-expected.txt:
platform/efl/tables/mozilla/dom/insertCellsExpand2-expected.txt:
platform/efl/tables/mozilla/dom/insertCellsRebuild1-expected.txt:
platform/efl/tables/mozilla/dom/insertCellsRebuild2-expected.txt:
platform/efl/tables/mozilla/dom/insertRowsExpand1-expected.txt:
platform/efl/tables/mozilla/dom/insertRowsRebuild1-expected.txt:
platform/efl/tables/mozilla/dom/tableDom-expected.txt:
platform/efl/tables/mozilla/marvin/body_col-expected.txt:
platform/efl/tables/mozilla/marvin/body_tbody-expected.txt:
platform/efl/tables/mozilla/marvin/body_tfoot-expected.txt:
platform/efl/tables/mozilla/marvin/body_thead-expected.txt:
platform/efl/tables/mozilla/marvin/col_span-expected.txt:
platform/efl/tables/mozilla/marvin/table_frame_border-expected.txt:
platform/efl/tables/mozilla/marvin/table_frame_box-expected.txt:
platform/efl/tables/mozilla/marvin/table_rules_all-expected.txt:
platform/efl/tables/mozilla/marvin/table_rules_none-expected.txt:
platform/efl/tables/mozilla/marvin/tables_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/tables_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/tables_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/tables_border_0-expected.txt:
platform/efl/tables/mozilla/marvin/tables_border_1-expected.txt:
platform/efl/tables/mozilla/marvin/tables_border_2-expected.txt:
platform/efl/tables/mozilla/marvin/tables_border_3-expected.txt:
platform/efl/tables/mozilla/marvin/tables_caption_align_bot-expected.txt:
platform/efl/tables/mozilla/marvin/tables_caption_align_top-expected.txt:
platform/efl/tables/mozilla/marvin/tables_cellspacing-expected.txt:
platform/efl/tables/mozilla/marvin/tables_default-expected.txt:
platform/efl/tables/mozilla/marvin/tables_id-expected.txt:
platform/efl/tables/mozilla/marvin/tables_row_th_nowrap-expected.txt:
platform/efl/tables/mozilla/marvin/tables_td_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/tables_td_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/tables_td_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/tables_td_colspan-expected.txt:
platform/efl/tables/mozilla/marvin/tables_td_height-expected.txt:
platform/efl/tables/mozilla/marvin/tables_td_nowrap-expected.txt:
platform/efl/tables/mozilla/marvin/tables_td_rowspan-expected.txt:
platform/efl/tables/mozilla/marvin/tables_th_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/tables_th_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/tables_th_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/tables_th_colspan-expected.txt:
platform/efl/tables/mozilla/marvin/tables_th_height-expected.txt:
platform/efl/tables/mozilla/marvin/tables_th_rowspan-expected.txt:
platform/efl/tables/mozilla/marvin/tbody_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/tbody_align_char-expected.txt:
platform/efl/tables/mozilla/marvin/tbody_align_justify-expected.txt:
platform/efl/tables/mozilla/marvin/tbody_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/tbody_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/tbody_char-expected.txt:
platform/efl/tables/mozilla/marvin/tfoot_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/tfoot_align_char-expected.txt:
platform/efl/tables/mozilla/marvin/tfoot_align_justify-expected.txt:
platform/efl/tables/mozilla/marvin/tfoot_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/tfoot_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/tfoot_char-expected.txt:
platform/efl/tables/mozilla/marvin/thead_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/thead_align_char-expected.txt:
platform/efl/tables/mozilla/marvin/thead_align_justify-expected.txt:
platform/efl/tables/mozilla/marvin/thead_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/thead_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/thead_char-expected.txt:
platform/efl/tables/mozilla/marvin/x_caption_align_bottom-expected.txt:
platform/efl/tables/mozilla/marvin/x_caption_align_top-expected.txt:
platform/efl/tables/mozilla/marvin/x_table-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_bgcolor_name-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_bgcolor_rgb-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_border-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_border_none-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_border_px-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_cellpadding-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_cellpadding_pct-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_cellspacing-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_cellspacing_pct-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_frame_void-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_rules_groups-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_rules_none-expected.txt:
platform/efl/tables/mozilla/marvin/x_table_style-expected.txt:
platform/efl/tables/mozilla/marvin/x_tbody_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/x_tbody_align_char-expected.txt:
platform/efl/tables/mozilla/marvin/x_tbody_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/x_tbody_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/x_tbody_class-expected.txt:
platform/efl/tables/mozilla/marvin/x_tbody_id-expected.txt:
platform/efl/tables/mozilla/marvin/x_tbody_style-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_bgcolor_name-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_bgcolor_rgb-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_class-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_colspan-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_height-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_id-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_nowrap-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_rowspan-expected.txt:
platform/efl/tables/mozilla/marvin/x_td_style-expected.txt:
platform/efl/tables/mozilla/marvin/x_tfoot_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/x_tfoot_align_char-expected.txt:
platform/efl/tables/mozilla/marvin/x_tfoot_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/x_tfoot_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/x_tfoot_class-expected.txt:
platform/efl/tables/mozilla/marvin/x_tfoot_id-expected.txt:
platform/efl/tables/mozilla/marvin/x_tfoot_style-expected.txt:
platform/efl/tables/mozilla/marvin/x_th_bgcolor_name-expected.txt:
platform/efl/tables/mozilla/marvin/x_th_bgcolor_rgb-expected.txt:
platform/efl/tables/mozilla/marvin/x_th_class-expected.txt:
platform/efl/tables/mozilla/marvin/x_th_colspan-expected.txt:
platform/efl/tables/mozilla/marvin/x_th_height-expected.txt:
platform/efl/tables/mozilla/marvin/x_th_id-expected.txt:
platform/efl/tables/mozilla/marvin/x_th_nowrap-expected.txt:
platform/efl/tables/mozilla/marvin/x_th_style-expected.txt:
platform/efl/tables/mozilla/marvin/x_thead_align_center-expected.txt:
platform/efl/tables/mozilla/marvin/x_thead_align_char-expected.txt:
platform/efl/tables/mozilla/marvin/x_thead_align_left-expected.txt:
platform/efl/tables/mozilla/marvin/x_thead_align_right-expected.txt:
platform/efl/tables/mozilla/marvin/x_thead_class-expected.txt:
platform/efl/tables/mozilla/marvin/x_thead_id-expected.txt:
platform/efl/tables/mozilla/marvin/x_thead_style-expected.txt:
platform/efl/tables/mozilla/marvin/x_tr_bgcolor_name-expected.txt:
platform/efl/tables/mozilla/marvin/x_tr_bgcolor_rgb-expected.txt:
platform/efl/tables/mozilla/marvin/x_tr_class-expected.txt:
platform/efl/tables/mozilla/marvin/x_tr_id-expected.txt:
platform/efl/tables/mozilla/marvin/x_tr_style-expected.txt:
platform/efl/tables/mozilla/other/body_col-expected.txt:
platform/efl/tables/mozilla/other/cellspacing-expected.txt:
platform/efl/tables/mozilla/other/move_row-expected.txt:
platform/efl/tables/mozilla/other/padding-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug10140-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug101759-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug10216-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug104898-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug1055-2-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug106336-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug11945-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug131020-3-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug14159-2-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug178855-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug18770-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug24880-1-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug25707-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug3166-11-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug3166-12-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug3166-13-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug3166-14-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug3166-16-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug3166-17-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug3166-18-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug32205-4-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug4294-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug46268-4-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug51000-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug58402-2-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug65372-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug6933-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug7113-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug73629-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug92647-1-expected.txt:
platform/efl/tables/mozilla_expected_failures/bugs/bug92868_1-expected.txt:
platform/efl/tables/mozilla_expected_failures/collapsing_borders/bug41262-5-expected.txt:
platform/efl/tables/mozilla_expected_failures/collapsing_borders/bug41262-6-expected.txt:
platform/efl/tables/mozilla_expected_failures/core/backgrounds-expected.txt:
platform/efl/tables/mozilla_expected_failures/core/captions3-expected.txt:
platform/efl/tables/mozilla_expected_failures/core/conflicts-expected.txt:
platform/efl/tables/mozilla_expected_failures/dom/appendCells1-expected.txt:
platform/efl/tables/mozilla_expected_failures/dom/appendCellsRebuild1-expected.txt:
platform/efl/tables/mozilla_expected_failures/dom/appendCol1-expected.txt:
platform/efl/tables/mozilla_expected_failures/dom/insertTbodyExpand1-expected.txt:
platform/efl/tables/mozilla_expected_failures/dom/insertTbodyRebuild1-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_frame_above-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_frame_below-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_frame_hsides-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_frame_lhs-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_frame_rhs-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_frame_void-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_frame_vsides-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_overflow_dirty_reflow_row-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_overflow_dirty_reflow_tbody-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_rules_cols-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/table_rules_rows-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/tables_caption_align_left-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/tables_caption_align_right-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_caption_align_left-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_caption_align_right-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_colgroup_width_px-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_frame_above-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_frame_below-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_frame_border-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_frame_box-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_frame_hsides-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_frame_lhs-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_frame_rhs-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_frame_vsides-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_rules_all-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_rules_cols-expected.txt:
platform/efl/tables/mozilla_expected_failures/marvin/x_table_rules_rows-expected.txt:

4:28 AM Changeset in webkit [196576] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

Fix the !(ENABLE(SVG_FONTS)

ENABLE(SVG_OTF_CONVERTER)) build after r196322

https://bugs.webkit.org/show_bug.cgi?id=154104

Reviewed by Myles C. Maxfield.

css/CSSFontFaceSource.cpp:

(WebCore::CSSFontFaceSource::CSSFontFaceSource):

2:30 AM Changeset in webkit [196575] by Antti Koivisto

5 edits
2 adds in trunk

Add test for class change style invalidation optimization
https://bugs.webkit.org/show_bug.cgi?id=154226

Reviewed by Myles Maxfield.

Test for https://trac.webkit.org/r196383

Source/WebCore:

Add internals.styleChangeType function.

Test: fast/css/style-invalidation-class-change-descendants.html

testing/Internals.cpp:

(WebCore::Internals::nodeNeedsStyleRecalc):
(WebCore::asString):
(WebCore::Internals::styleChangeType):
(WebCore::Internals::description):

testing/Internals.h:
testing/Internals.idl:

LayoutTests:

fast/css/style-invalidation-class-change-descendants-expected.txt: Added.
fast/css/style-invalidation-class-change-descendants.html: Added.

1:50 AM Changeset in webkit [196574] by Hunseop Jeong

2 edits in trunk/LayoutTests

Unreviewed. EFL gardening. Mark more video tests to failure.

platform/efl/TestExpectations: Added more crash tests and moved the tests to upper position.

1:12 AM Changeset in webkit [196573] by commit-queue@webkit.org

9 edits in trunk/Source/JavaScriptCore

[JSC] Improve the interface of Inst::shouldTryAliasingDef()
https://bugs.webkit.org/show_bug.cgi?id=154227

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-15
Reviewed by Andreas Kling.

Using Optional<> instead of a bool+reference looks cleaner
at the call sites.

b3/B3CheckSpecial.cpp:

(JSC::B3::CheckSpecial::shouldTryAliasingDef):

b3/B3CheckSpecial.h:
b3/air/AirCustom.h:

(JSC::B3::Air::PatchCustom::shouldTryAliasingDef):

b3/air/AirInst.h:
b3/air/AirInstInlines.h:

(JSC::B3::Air::Inst::shouldTryAliasingDef):

b3/air/AirIteratedRegisterCoalescing.cpp:
b3/air/AirSpecial.cpp:

(JSC::B3::Air::Special::shouldTryAliasingDef):

b3/air/AirSpecial.h:

12:39 AM Changeset in webkit [196572] by Gyuyoung Kim

2 edits in trunk/Source/WebKit2

[CMake][Mac] Remove WKNPAPIPlugInContainer.mm in WebKit2/PlatformMac.cmake
https://bugs.webkit.org/show_bug.cgi?id=154234

Reviewed by Csaba Osztrogonác.

PlatformMac.cmake: Remove WKNPAPIPlugInContainer.mm.

Feb 14, 2016:

9:10 PM Changeset in webkit [196571] by Simon Fraser

3 edits
2 adds in trunk

[CSS Filters] When applying an SVG filter on a composited image using CSS the image is rendered without the filter
https://bugs.webkit.org/show_bug.cgi?id=154108

Reviewed by Sam Weinig.
Source/WebCore:

When checking whether we can directly composite an image, we need to check for software-rendered
filters.

Test: compositing/filters/simple-image-with-svg-filter.html

rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::isDirectlyCompositedImage):

LayoutTests:

compositing/filters/simple-image-with-svg-filter-expected.html: Added.
compositing/filters/simple-image-with-svg-filter.html: Added.

8:49 PM Changeset in webkit [196570] by Chris Dumez

2 edits in trunk/Source/WebKit2

Unreviewed, land an additional Mac CMake build fix.

PlatformMac.cmake:

8:47 PM Changeset in webkit [196569] by Chris Dumez

3 edits in trunk/Source/WebKit/win

Unreviewed Window build fix.

WebCoreStatistics.cpp:
WebJavaScriptCollector.cpp:

8:43 PM Changeset in webkit [196568] by Chris Dumez

46 edits in trunk/Source/WebCore

Drop the [EventTarget] WebKit-specific IDL extended attribute
https://bugs.webkit.org/show_bug.cgi?id=154171

Reviewed by Sam Weinig.

Drop the [EventTarget] WebKit-specific IDL extended attribute now that
all interfaces inherit EventTarget when they should.

No new tests, no Web-Exposed behavior change.

Modules/battery/BatteryManager.idl:
Modules/encryptedmedia/MediaKeySession.idl:
Modules/indexeddb/IDBDatabase.idl:
Modules/indexeddb/IDBOpenDBRequest.idl:
Modules/indexeddb/IDBRequest.idl:
Modules/indexeddb/IDBTransaction.idl:
Modules/mediasession/MediaRemoteControls.idl:
Modules/mediasource/MediaSource.idl:
Modules/mediasource/SourceBuffer.idl:
Modules/mediasource/SourceBufferList.idl:
Modules/mediastream/MediaStream.idl:
Modules/mediastream/MediaStreamTrack.idl:
Modules/mediastream/RTCDTMFSender.idl:
Modules/mediastream/RTCDataChannel.idl:
Modules/mediastream/RTCPeerConnection.idl:
Modules/notifications/Notification.idl:
Modules/speech/SpeechSynthesisUtterance.idl:
Modules/webaudio/AudioContext.idl:
Modules/webaudio/AudioNode.idl:
Modules/webaudio/OfflineAudioContext.idl:
Modules/websockets/WebSocket.idl:
bindings/scripts/CodeGeneratorGObject.pm:

(ImplementsInterface):
(SkipFunction): Deleted.
(GenerateCFile): Deleted.

bindings/scripts/CodeGeneratorJS.pm:

(InstanceNeedsVisitChildren):
(GenerateImplementation):

bindings/scripts/IDLAttributes.txt:
bindings/scripts/test/TestEventTarget.idl:
bindings/scripts/test/TestNode.idl:
css/FontLoader.idl:
dom/EventTarget.idl:
dom/MessagePort.idl:
dom/Node.idl:
dom/WebKitNamedFlow.idl:
fileapi/FileReader.idl:
html/MediaController.idl:
html/track/AudioTrackList.idl:
html/track/TextTrack.idl:
html/track/TextTrackCue.idl:
html/track/TextTrackList.idl:
html/track/VideoTrackList.idl:
loader/appcache/DOMApplicationCache.idl:
page/DOMWindow.idl:
page/EventSource.idl:
page/Performance.idl:
workers/WorkerGlobalScope.idl:
xml/XMLHttpRequest.idl:
xml/XMLHttpRequestUpload.idl:

7:53 PM Changeset in webkit [196567] by Chris Dumez

2 edits in trunk/Source/WebCore

Unreviewed attempt to fix the Mac CMake build after r196136

PlatformMac.cmake:

7:47 PM Changeset in webkit [196566] by Chris Dumez

4 edits in trunk/Source/WebCore

Unreviewed attempt to fix the Windows build.

Modules/webdatabase/Database.cpp:
bridge/c/c_utility.cpp:
platform/MemoryPressureHandler.cpp:

6:23 PM Changeset in webkit [196565] by bshafiei@apple.com

5 edits in tags/Safari-601.5.17.1/Source

Versioning.

6:22 PM Changeset in webkit [196564] by bshafiei@apple.com

1 copy in tags/Safari-601.5.17.1

New tag.

6:17 PM Changeset in webkit [196563] by Chris Dumez

29 edits
3 adds in trunk

Window and WorkerGlobalScope should inherit EventTarget
https://bugs.webkit.org/show_bug.cgi?id=154170
<rdar://problem/24642377>

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline now that a couple of checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Window and WorkerGlobalScope should inherit EventTarget instead of
duplicating the EventTarget API in their IDL. These were the last
interfaces that needed fixing. The next step will be to get rid
of the [EventTarget] IDL extended attribute and rely entirely
on the EventTarget inheritance.

Test:

fast/frames/detached-frame-eventListener.html
Covered by existing tests.

WebCore.xcodeproj/project.pbxproj:

Add JSEventTargetCustom.h header to the project.

bindings/js/JSDOMWindowCustom.cpp:

Drop custom bindings for Window's addEventListener() and
removeEventListener(). The only reason these needed custom
code was to add a check for frameless windows. The frameless
Window checks was moved to the respective methods in the
JSEventTarget generated bindings.

bindings/js/JSDOMWindowShell.cpp:

(WebCore::JSDOMWindowShell::setWindow):
Set WindowPrototype's prototype to EventTarget's prototype.

bindings/js/JSDOMWindowShell.h:
bindings/js/JSDictionary.cpp:

Include "DOMWindow.h" to fix the build.

bindings/js/JSEventTargetCustom.cpp:

(WebCore::JSEventTarget::toWrapped):
Handle DOMWindow and WorkerGlobalScope explicitely in toWrapped()
and get rid of the DOM_EVENT_TARGET_INTERFACES_FOR_EACH(TRY_TO_UNWRAP_WITH_INTERFACE)
now that all interfaces inherit EventTarget when they should.
The reason DOMWindow and WorkerGlobalScope still need special
handling is because their wrappers (JSDOMWindow /
JSWorkerGlobalScope) do not subclass JSEventTarget.

(WebCore::JSEventTargetOrGlobalScope::create):

bindings/js/JSEventTargetCustom.h: Added.

(WebCore::JSEventTargetOrGlobalScope::wrapped):
(WebCore::JSEventTargetOrGlobalScope::operator JSC::JSObject&):
(WebCore::JSEventTargetOrGlobalScope::JSEventTargetOrGlobalScope):
Add a wrapper type for JSEventTarget / JSDOMWindow and
JSWorkerGlobalScope for use in the generated bindings. This is
needed because JSDOMWindow and JSWorkerGlobalScope do not
subclass JSEventTarget. Subclassing JSEventTarget would be
complicated for them because they already subclass
JSDOMWindowBase / JSWorkerGlobalScopeBase, which subclasses
JSDOMGlobalObject.

bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::initScript):
Set WorkerGlobalScopePrototype's prototype to EventTarget's prototype.

bindings/scripts/CodeGeneratorJS.pm:

(ShouldGenerateToJSDeclaration):
Do not generate to toJS() implementation for interfaces that use
the [CustomProxyToJSObject] IDL extended attribute, even if they
inherit EventTarget.

(GetCastingHelperForThisObject):
To initialize castedThis from thisValue JSValue, we now use the
JSEventTargetOrGlobalScope wrapper for the EventTarget
implementation. This is to work around the fact that JSDOMWindow
and JSWorkerGlobalScope do not subclass JSEventTarget.

(GenerateFunctionCastedThis):

Drop code handling [WorkerGlobalScope] IDL extended attribute as there is no such attribute.
Use auto instead of auto* type for castedThis because JSEventTargetOrGlobalScope::create() returns a unique_ptr.
Do not check that castedThis inherits JSEventTarget in the EventTarget bindings code as this no longer holds true.

(GenerateImplementation):
Generate frameless window() and security checks for EventTarget
methods when thisValue is a JSDOMWindow.

dom/EventTarget.idl:

Add [JSCustomHeader] IDL Extended attribute as we need a header
to expose JSEventTargetOrGlobalScope class.

page/DOMWindow.idl:
workers/WorkerGlobalScope.idl:

Inherit EventTarget and stop duplicating the EventTarget API.
This matches the HTML specification.

LayoutTests:

fast/frames/detached-frame-eventListener-expected.txt: Added.
fast/frames/detached-frame-eventListener.html: Added.

Add test case to cover the use of the EventListener API on a detached
frame.

fast/loader/window-clearing-expected.txt:

Rebaseline now that window has one more object in its prototype chain.

http/tests/security/cross-frame-access-call-expected.txt:
http/tests/security/cross-frame-access-call.html:

Add test coverage for cross-origin access to window.dispatchEvent() which
should not be allowed, in addition to window.addEventListener() and
window.removeEventListener() which were already tested.

5:42 PM Changeset in webkit [196562] by BJ Burg

7 edits in trunk/Source

WKAutomationDelegate's requestAutomationSession should take a suggested session identifier
https://bugs.webkit.org/show_bug.cgi?id=154012
<rdar://problem/24557697>

Reviewed by Darin Adler.

Source/JavaScriptCore:

Add a string parameter to the client method for requesting a new session.

inspector/remote/RemoteInspector.h:

Source/WebKit2:

Add a string parameter to the delegate method for requesting a new session.

UIProcess/API/APIAutomationClient.h:

(API::AutomationClient::didRequestAutomationSession):
(API::AutomationClient::requestAutomationSession): Deleted.
Rename the client method to better match the delegate method's name.

UIProcess/API/Cocoa/_WKAutomationDelegate.h:
UIProcess/Cocoa/AutomationClient.h:
UIProcess/Cocoa/AutomationClient.mm:

(WebKit::AutomationClient::AutomationClient):
(WebKit::AutomationClient::requestAutomationSession):

5:26 PM Changeset in webkit [196561] by Darin Adler

3 edits in trunk/Source/WebCore

Small tweaks to some SimpleLineLayout code
https://bugs.webkit.org/show_bug.cgi?id=154229

Reviewed by Zalan Bujtas.

rendering/SimpleLineLayoutFunctions.cpp:

(WebCore::SimpleLineLayout::paintFlow): Use std::ceil instead of ceilf.
Use auto instead of const auto& for a for loop where the local object is
copied and not a reference.
(WebCore::SimpleLineLayout::hitTestFlow): Use modern for loop.
(WebCore::SimpleLineLayout::collectFlowOverflow): Use std::ceil instead of
ceilf. Use a modern for loop, and use slightly more descriptive local
variable names.
(WebCore::SimpleLineLayout::computeBoundingBox): Use auto instead of
const auto& as above.
(WebCore::SimpleLineLayout::computeFirstRunLocation): Use auto and use
the name "range" for the range rather than the name "it", since the range
is not an iterator.
(WebCore::SimpleLineLayout::collectAbsoluteRects): Use auto instead of
const auto& as above.
(WebCore::SimpleLineLayout::collectAbsoluteQuads): Ditto.
(WebCore::SimpleLineLayout::showLineLayoutForFlow): Use modern for loop.

rendering/SimpleLineLayoutResolver.cpp:

(WebCore::SimpleLineLayout::RunResolver::Run::text): Convert from a String
to a StringView using the StringView constructor instead of writing out
explicit 8-bit and 16-bit cases.

1:57 AM Changeset in webkit [196560] by Antti Koivisto

5 edits
2 adds in trunk/Source/WebCore

Factor class change style invalidation code into a class
https://bugs.webkit.org/show_bug.cgi?id=154163

Reviewed by Andreas Kling.

Factor this piece of functionality out of Element and into ClassChangeInvalidation class.

CMakeLists.txt:
WebCore.vcxproj/WebCore.vcxproj:
WebCore.xcodeproj/project.pbxproj:
dom/Element.cpp:

(WebCore::classStringHasClassName):
(WebCore::Element::classAttributeChanged):
(WebCore::collectClasses): Deleted.
(WebCore::computeClassChange): Deleted.
(WebCore::invalidateStyleForClassChange): Deleted.

style/ClassChangeInvalidation.cpp: Added.

(WebCore::Style::ClassChangeInvalidation::computeClassChange):
(WebCore::Style::ClassChangeInvalidation::invalidateStyle):

style/ClassChangeInvalidation.h: Added.

(WebCore::Style::ClassChangeInvalidation::needsInvalidation):
(WebCore::Style::ClassChangeInvalidation::ClassChangeInvalidation):
(WebCore::Style::ClassChangeInvalidation::~ClassChangeInvalidation):

Feb 13, 2016:

6:20 PM Changeset in webkit [196559] by mmaxfield@apple.com

2 edits in trunk/Source/WebCore

[Win] [SVG -> OTF Converter] SVG fonts drawn into ImageBuffers are invisible
https://bugs.webkit.org/show_bug.cgi?id=154222

Reviewed by Antti Koivisto.

Windows ImageBuffer code is sensitive to broken bounding box and
descent code.

Covered by existing tests.

svg/SVGToOTFFontConversion.cpp:

(WebCore::SVGToOTFFontConverter::appendHHEATable):
(WebCore::SVGToOTFFontConverter::appendOS2Table):
(WebCore::SVGToOTFFontConverter::processGlyphElement):
(WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter):

6:17 PM Changeset in webkit [196558] by mitz@apple.com

2 edits in trunk/Source/WebInspectorUI

Removed the unused Frameworks group.

Rubber-stamped by Sam Weinig.

WebInspectorUI.xcodeproj/project.pbxproj:

5:47 PM Changeset in webkit [196557] by timothy@apple.com

2 edits in trunk/Websites/webkit.org

Adjust the appearance of mattewhite figures that are not widescreen.

wp-content/themes/webkit/style.css:

(article .mattewhite:not(.widescreen):

2:48 PM Changeset in webkit [196556] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

v3 UI sometimes shows same dates twice on the x-axis of time series charts
https://bugs.webkit.org/show_bug.cgi?id=154210

Reviewed by Chris Dumez.

The bug was caused by the label generation code in TimeSeriesChart.computeTimeGrid never emitting hours.

Use hours instead of dates as labels when the current time's date is same as the previous label's date.
Always include dates before entering this mode to avoid just having hours as labels on the entire x-axis.

public/v3/components/time-series-chart.js:

(TimeSeriesChart.prototype._renderXAxis): Slightly increase the "average" width of x-axis label.
(TimeSeriesChart.computeTimeGrid): See above. Also assert that the number of labels we generate never
exceeds maxLabels as a sanity check.
(TimeSeriesChart._timeIterators): Added an iterator that increments by two hours for zoomed graphs.

2:45 PM Changeset in webkit [196555] by Antti Koivisto

6 edits in trunk/Source/WebCore

Add version number for default stylesheet
https://bugs.webkit.org/show_bug.cgi?id=154220

Reviewed by Ryosuke Niwa.

We currently fail to update RuleFeatureSets for shadow trees when the default stylesheet grows
(for example when media controls stylesheet is initialized).

No test since this is not causing known bugs. It is blocking optimizations in shadow trees that
rely on rule features being up-to-date.

css/CSSDefaultStyleSheets.cpp:

(WebCore::CSSDefaultStyleSheets::loadSimpleDefaultStyle):
(WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement):

Increment version number when the default stylesheet changes.

css/CSSDefaultStyleSheets.h:
css/DocumentRuleSets.cpp:

(WebCore::DocumentRuleSets::appendAuthorStyleSheets):
(WebCore::DocumentRuleSets::collectFeatures):

Store the current default stylesheet version number.

css/DocumentRuleSets.h:

(WebCore::DocumentRuleSets::features):

Collect features again if the default stylesheet has changed.

css/StyleResolver.cpp:

(WebCore::StyleResolver::styleForElement):

2:39 PM Changeset in webkit [196554] by mark.lam@apple.com

3 edits in trunk/Source/WTF

Eliminate the need for WTFCrashImpl().
https://bugs.webkit.org/show_bug.cgi?id=154202

Reviewed by Alexey Proskuryakov.

wtf/Assertions.cpp:
wtf/Assertions.h:

1:30 PM Changeset in webkit [196553] by rniwa@webkit.org

7 edits in trunk/Websites/perf.webkit.org

v3 UI should show status and associated bugs on analysis task pages
https://bugs.webkit.org/show_bug.cgi?id=154212

Reviewed by Chris Dumez.

Added the capability to see and modify the status and the list of associated of bugs on analysis task pages.

Also added the list of related tasks, which are analysis tasks associated with the same bug or have
overlapping time ranges with the same test metric but on a potentially different platform.

In addition, categorize analysis tasks with the status of "no change" or "inconclusive" as "closed" as no
further action can be taken (users can bring them back to non-closed state without any restrictions).

public/api/analysis-tasks.php:

(format_task): Categorize 'unchanged' and 'inconclusive' analysis tasks as closed.

public/privileged-api/associate-bug.php:

(main): Added shouldDelete as a new mechanism to disassociate a bug since v3 UI shares a single Bug object
between multiple analysis tasks (as it should have been in the first place).

public/v3/components/chart-pane-base.js:

(ChartPaneBase):
(ChartPaneBase.prototype._fetchAnalysisTasks): Since each analysis task's change type (status/result) could
change, we need to create annotation objects during each render() call.
(ChartPaneBase.prototype.render):
(ChartPaneBase.prototype._renderAnnotations): Extracted from ChartPaneBase.prototype._fetchAnalysisTasks to
do that. I was afraid of the perf impact of this but it doesn't seem to be an issue in my testing.
(ChartPaneBase.cssTemplate): Removed superfluous margins (moved to ChartPane.cssTemplate) around the charts
since they are only useful in the charts page.

public/v3/models/analysis-task.js:

(AnalysisTask):
(AnalysisTask.prototype.updateSingleton): Added a comment as to why object.result cannot be renamed to
object.changeType in the JSON API.
(AnalysisTask.prototype.updateName): Added.
(AnalysisTask.prototype.updateChangeType): Added.
(AnalysisTask.prototype._updateRemoteState): Added.
(AnalysisTask.prototype.associateBug): Added.
(AnalysisTask.prototype.disassociateBug): Added.
(AnalysisTask.fetchRelatedTasks): Added. See above for the criteria of related-ness.

public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage):
(AnalysisTaskPage.prototype.updateFromSerializedState):
(AnalysisTaskPage.prototype._fetchRelatedInfoForTaskId): Extracted from updateFromSerializedState.
(AnalysisTaskPage.prototype._didFetchRelatedAnalysisTasks): Added.
(AnalysisTaskPage.prototype.render): Render the list of associated bugs, the list of bug trackers (so that
users can use it to associate with a new bug), and the list of related analysis tasks.
(AnalysisTaskPage.prototype._renderTestGroupList): Extracted from render since it was getting too long.
(AnalysisTaskPage.prototype._renderTestGroupDetails): Ditto.
(AnalysisTaskPage.prototype._updateChangeType): Added.
(AnalysisTaskPage.prototype._associateBug): Added.
(AnalysisTaskPage.prototype._disassociateBug): Added.
(AnalysisTaskPage.htmlTemplate): Added various elements to show and modify the status, associate bugs,
and a list of related analysis tasks.
(AnalysisTaskPage.cssTemplate): Added various styles for those form controls.

public/v3/pages/chart-pane.js:

(ChartPane.cssTemplate): Moved the margins from ChartPaneBase.cssTemplate.

11:12 AM Changeset in webkit [196552] by commit-queue@webkit.org

3 edits
1 add in trunk/Source/WebCore

[cmake] Consolidate building of GStreamer and OpenWebRTC code.
https://bugs.webkit.org/show_bug.cgi?id=154116

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-13
Reviewed by Michael Catanzaro.

No new tests needed.

PlatformEfl.cmake: Migrated shared code to GStreamer.cmake.
PlatformGTK.cmake: Ditto.
platform/GStreamer.cmake: Added.

9:41 AM Changeset in webkit [196551] by mark.lam@apple.com

7 edits in trunk/Source

Add thread violation checks to WebView public APIs.
https://bugs.webkit.org/show_bug.cgi?id=154183

Reviewed by Timothy Hatcher.

Source/WebCore:

No new tests. Just adding a new thread violation round.

platform/ThreadCheck.h:
platform/mac/ThreadCheck.mm:
Adding WebCoreThreadViolationCheckRoundThree().

Source/WebKit/mac:

Re-landing r196527 with a newly added WebCoreThreadViolationCheckRoundThree().
Previously was using WebCoreThreadViolationCheckRoundTwo().

Misc/WebKitVersionChecks.h:
WebView/WebFrameView.mm:

(-[WebFrameView initWithFrame:]):

WebView/WebView.mm:

(-[WebView setCustomTextEncodingName:]):
(-[WebView stringByEvaluatingJavaScriptFromString:]):
(-[WebView windowScriptObject]):
(-[WebView setGroupName:]):
(-[WebView setMainFrameURL:]):
(-[WebView mainFrameTitle]):
(-[WebView mainFrameIcon]):
(-[WebView setDrawsBackground:]):
(-[WebView setShouldUpdateWhileOffscreen:]):

5:38 AM Changeset in webkit [196550] by timothy@apple.com

2 edits in trunk/Source/JavaScriptCore

Fix WebAssembly bug URL in the feature list.

features.json:

1:23 AM Changeset in webkit [196549] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: DataGrid Header Cells should have Context Menu for Sorting
https://bugs.webkit.org/show_bug.cgi?id=154050

Patch by Devin Rousso <Devin Rousso> on 2016-02-13
Reviewed by Joseph Pecoraro.

Localizations/en.lproj/localizedStrings.js:
UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid.prototype.set sortOrder):
(WebInspector.DataGrid.prototype._toggledSortOrder):
Returns the opposite sort order from the current order.

(WebInspector.DataGrid.prototype._selectSortColumnAndSetOrder):
Changes the selected column to the one with the specified identifier and
then switches the sort order to the given order.

(WebInspector.DataGrid.prototype._headerCellClicked):
Moved logic for switching cells/sort-order to a separate function for
better reusability.

(WebInspector.DataGrid.prototype._contextMenuInHeader):
Adds context menu items on DataGrid header items to change the current
sort order to the specified order. If the context menu is on the selected
header item, only show the sort order that is not currently applied.

12:49 AM Changeset in webkit [196548] by Carlos Garcia Campos

4 edits in trunk/Source/WebKit2

Unreviewed. Fix GTK+ and hopefully EFL build after r196499.

UIProcess/Launcher/efl/ProcessLauncherEfl.cpp:

(WebKit::ProcessLauncher::launchProcess):

UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp:

(WebKit::ProcessLauncher::launchProcess):

UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp:

(WebKit::PluginProcessProxy::platformGetLaunchOptions):

Feb 12, 2016:

11:21 PM Changeset in webkit [196547] by Sukolsak Sakshuwong

2 edits in trunk/Source/JavaScriptCore

Change the last RefPtr::get() to release() in String.prototype.normalize
https://bugs.webkit.org/show_bug.cgi?id=154211

Reviewed by Ryosuke Niwa.

Change the last RefPtr::get() to release() in String.prototype.normalize.

runtime/StringPrototype.cpp:

(JSC::normalize):

9:24 PM Changeset in webkit [196546] by n_wang@apple.com

20 edits
2 adds in trunk

AX: Implement paragraph related text marker functions using TextIterator
https://bugs.webkit.org/show_bug.cgi?id=154098
<rdar://problem/24269675>

Reviewed by Chris Fleizach.

Source/WebCore:

Using CharacterOffset to implement paragraph related text marker calls. Reused
logic from VisibleUnits class. And refactored textMarkerForCharacterOffset method
to get better performance. Also fixed an issue where we can't navigate through a text
node with line breaks in it using next/previousCharacterOffset call.

Test: accessibility/mac/text-marker-paragraph-nav.html

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::traverseToOffsetInRange):
(WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
(WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
(WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
(WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
(WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):
(WebCore::AXObjectCache::nextNode):
(WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
(WebCore::AXObjectCache::nextCharacterOffset):
(WebCore::AXObjectCache::previousCharacterOffset):
(WebCore::startWordBoundary):
(WebCore::AXObjectCache::startCharacterOffsetOfWord):
(WebCore::AXObjectCache::endCharacterOffsetOfWord):
(WebCore::AXObjectCache::previousWordStartCharacterOffset):
(WebCore::AXObjectCache::previousWordBoundary):
(WebCore::AXObjectCache::startCharacterOffsetOfParagraph):
(WebCore::AXObjectCache::endCharacterOffsetOfParagraph):
(WebCore::AXObjectCache::paragraphForCharacterOffset):
(WebCore::AXObjectCache::nextParagraphEndCharacterOffset):
(WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
(WebCore::AXObjectCache::rootAXEditableElement):

accessibility/AXObjectCache.h:

(WebCore::CharacterOffset::remaining):
(WebCore::CharacterOffset::isNull):
(WebCore::CharacterOffset::isEqual):
(WebCore::AXObjectCache::isNodeInUse):

accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(+[WebAccessibilityTextMarker textMarkerWithCharacterOffset:cache:]):
(-[WebAccessibilityObjectWrapper nextMarkerForCharacterOffset:]):
(-[WebAccessibilityObjectWrapper previousMarkerForCharacterOffset:]):
(-[WebAccessibilityObjectWrapper rangeForTextMarkers:]):

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(startOrEndTextmarkerForRange):
(nextTextMarkerForCharacterOffset):
(previousTextMarkerForCharacterOffset):
(-[WebAccessibilityObjectWrapper nextTextMarkerForCharacterOffset:]):
(-[WebAccessibilityObjectWrapper previousTextMarkerForCharacterOffset:]):
(-[WebAccessibilityObjectWrapper textMarkerForCharacterOffset:]):
(textMarkerForCharacterOffset):
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
(-[WebAccessibilityObjectWrapper nextTextMarkerForNode:offset:]): Deleted.
(-[WebAccessibilityObjectWrapper previousTextMarkerForNode:offset:]): Deleted.
(-[WebAccessibilityObjectWrapper textMarkerForNode:offset:ignoreStart:]): Deleted.
(-[WebAccessibilityObjectWrapper textMarkerForNode:offset:]): Deleted.

editing/VisibleUnits.cpp:

(WebCore::nextSentencePosition):
(WebCore::findStartOfParagraph):
(WebCore::findEndOfParagraph):
(WebCore::startOfParagraph):
(WebCore::endOfParagraph):

editing/VisibleUnits.h:

Tools:

DumpRenderTree/AccessibilityUIElement.cpp:

(nextWordEndTextMarkerForTextMarkerCallback):
(paragraphTextMarkerRangeForTextMarkerCallback):
(previousParagraphStartTextMarkerForTextMarkerCallback):
(nextParagraphEndTextMarkerForTextMarkerCallback):
(setSelectedVisibleTextRangeCallback):
(AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):
(AccessibilityUIElement::paragraphTextMarkerRangeForTextMarker):
(AccessibilityUIElement::previousParagraphStartTextMarkerForTextMarker):
(AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):
(AccessibilityUIElement::getJSClass):

DumpRenderTree/AccessibilityUIElement.h:
DumpRenderTree/ios/AccessibilityUIElementIOS.mm:

(AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):
(AccessibilityUIElement::paragraphTextMarkerRangeForTextMarker):
(AccessibilityUIElement::previousParagraphStartTextMarkerForTextMarker):
(AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):

DumpRenderTree/mac/AccessibilityUIElementMac.mm:

WebKitTestRunner/InjectedBundle/AccessibilityUIElement.cpp:

(WTR::AccessibilityUIElement::rightWordTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::previousWordStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::paragraphTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::previousParagraphStartTextMarkerForTextMarker):

WebKitTestRunner/InjectedBundle/AccessibilityUIElement.h:
WebKitTestRunner/InjectedBundle/Bindings/AccessibilityUIElement.idl:
WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:

(WTR::AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::paragraphTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::previousParagraphStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::mathPostscriptsDescription):

WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:

(WTR::AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::paragraphTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::previousParagraphStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker):
(WTR::_convertMathMultiscriptPairsToString):

LayoutTests:

accessibility/mac/text-marker-paragraph-nav-expected.txt: Added.
accessibility/mac/text-marker-paragraph-nav.html: Added.
accessibility/text-marker/text-marker-previous-next-expected.txt:
accessibility/text-marker/text-marker-previous-next.html:

8:52 PM Changeset in webkit [196545] by sbarati@apple.com

7 edits in trunk

[ES6] we have an incorrect syntax error when a callee of a function expression has the same name as a top-level lexical declaration
https://bugs.webkit.org/show_bug.cgi?id=154143

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

We were raising syntax errors on the following type of programs when
we shouldn't have been.
`
(function foo() { const foo = 20; });
`

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseFunctionInfo):

parser/Parser.h:

(JSC::Scope::computeLexicallyCapturedVariablesAndPurgeCandidates):
(JSC::Scope::declareCallee):
(JSC::Scope::declareVariable):
(JSC::Scope::hasDeclaredVariable):
(JSC::Scope::hasLexicallyDeclaredVariable):
(JSC::Scope::hasDeclaredParameter):
(JSC::Scope::declareWrite):
(JSC::Scope::getCapturedVars):

LayoutTests:

js/basic-strict-mode-expected.txt:
js/let-syntax-expected.txt:
js/script-tests/let-syntax.js:

8:48 PM Changeset in webkit [196544] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

[JSC] ZeroExtend and SignExtend use incorrect addressing on ARM64
https://bugs.webkit.org/show_bug.cgi?id=154208

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-12
Reviewed by Filip Pizlo.

When lowering:

@1 = Load32(@x)
@2 = SExt8(@1)

LowerToAir would see there is a form of SignExtend8To32 (an alias for Load8S)
and use that.

There are two problems with that:
1) If we have an Addr, it went through legalizeMemoryOffsets() for a 32bits

load. If used on an other kind of load, there is no guarantee the addressing
is still valid.

2) If we have an Index, it is computed for the 32bits MemoryValue.

The computed index is not valid for the 8bits load.

(2) could be fixed by changing LowerToAir to use the current instruction width
instead of the B3ValueWidth but that's a bit tricky. We should just embrace
that one of our target is a Load-Store architecture.

In this patch, I just disabled the faulty forms on ARM64. We still need those operations
to be fast, this will be addressed in: https://bugs.webkit.org/show_bug.cgi?id=154207

I also strengthened the m_allowScratchRegister assertion. The instructions that do not
invalidate the temporary did not run the assertion, making this harder to debug.

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::load8):
(JSC::MacroAssemblerARM64::store64):
(JSC::MacroAssemblerARM64::store32):
(JSC::MacroAssemblerARM64::loadDouble):
(JSC::MacroAssemblerARM64::storeDouble):
(JSC::MacroAssemblerARM64::branch32):
(JSC::MacroAssemblerARM64::branch64):
(JSC::MacroAssemblerARM64::getCachedDataTempRegisterIDAndInvalidate):
(JSC::MacroAssemblerARM64::getCachedMemoryTempRegisterIDAndInvalidate):
(JSC::MacroAssemblerARM64::dataMemoryTempRegister):
(JSC::MacroAssemblerARM64::cachedMemoryTempRegister):
(JSC::MacroAssemblerARM64::load):
(JSC::MacroAssemblerARM64::store):

b3/air/AirOpcode.opcodes:

7:18 PM Changeset in webkit [196543] by bshafiei@apple.com

5 edits in branches/safari-601-branch/Source

Versioning.

7:13 PM Changeset in webkit [196542] by Jon Davis

2 edits in trunk/Websites/webkit.org

Add a CSS class to remove padding when using mattewhite class for figures
https://bugs.webkit.org/show_bug.cgi?id=154206

Reviewed by Filip Pizlo.

wp-content/themes/webkit/style.css:

(article .two-columns):
(article .two-columns h6):
(article .two-columns p):
(article .mattewhite):
(article .mattewhite.tightwad):
(article figure):

6:37 PM Changeset in webkit [196541] by msaboff@apple.com

8 edits in trunk/Source/JavaScriptCore

offlineasm: Emit Dwarf2 file and location directives to allow for debugging .asm files
https://bugs.webkit.org/show_bug.cgi?id=152703

Reviewed by Mark Lam.

Added support to output Dwarf2 .file and .loc assembler directives to provide the debugging
information needed to correlate the offline assembler generated code with the source lines
in the .asm files.

Changed the tracking of file data to include a file index that was provided to the .file
directive. That index is used when emitting the .loc directives.

offlineasm/arm.rb:
offlineasm/arm64.rb:
offlineasm/asm.rb:
offlineasm/backends.rb:
offlineasm/config.rb:
offlineasm/parser.rb:
offlineasm/x86.rb:

6:07 PM Changeset in webkit [196540] by bshafiei@apple.com

1 copy in tags/Safari-601.5.17

New tag.

6:00 PM Changeset in webkit [196539] by fpizlo@apple.com

1 edit
14 adds in trunk/Websites/webkit.org

Unreviewed, upload some blog files.

blog-files/compile-times.png: Added.
blog-files/fast-isel.png: Added.
blog-files/jetstream-latency.png: Added.
blog-files/jetstream-throughput.png: Added.
blog-files/jetstream.png: Added.
blog-files/kraken.png: Added.
blog-files/low-compile-times.png: Added.
blog-files/low-fast-isel.png: Added.
blog-files/low-jetstream-latency.png: Added.
blog-files/low-jetstream-throughput.png: Added.
blog-files/low-jetstream.png: Added.
blog-files/low-kraken.png: Added.
blog-files/low-octane.png: Added.
blog-files/octane.png: Added.

5:49 PM Changeset in webkit [196538] by jiewen_tan@apple.com

3 edits in trunk/LayoutTests

Unreviewed, build fix after r196520

inspector/model/remote-object-get-properties-expected.txt:
platform/mac/inspector/model/remote-object-expected.txt:

5:39 PM Changeset in webkit [196537] by bshafiei@apple.com

5 edits in branches/safari-601.1.46-branch/Source

Versioning.

5:10 PM Changeset in webkit [196536] by msaboff@apple.com

5 edits in trunk/Source/bmalloc

BASSERTs added in r196421 are causing debug test failures
https://bugs.webkit.org/show_bug.cgi?id=154113

Reviewed by Geoffrey Garen.

bmalloc/FreeList.h:

(bmalloc::FreeList::push): Added BASSERT to catch adding unmerged free objects

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateLarge): Changed to use nextCanMerge().

bmalloc/LargeObject.h:

bmalloc/VMHeap.h:

(bmalloc::VMHeap::allocateLargeObject): Moved adding the extra object back to the free list
to after we set the object we'll return as being allocated.
(bmalloc::VMHeap::deallocateLargeObject):

5:05 PM Changeset in webkit [196535] by mark.lam@apple.com

3 edits in trunk/Source/bmalloc

Make BCRASH() use breakpoint traps too for non-debug OS(DARWIN).
https://bugs.webkit.org/show_bug.cgi?id=154184

Reviewed by Saam Barati.

This makes it behave consistently with WTFCrash().

bmalloc/BAssert.h:
bmalloc/BPlatform.h:

4:42 PM Changeset in webkit [196534] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196520

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

4:40 PM Changeset in webkit [196533] by bshafiei@apple.com

1 copy in tags/Safari-601.1.46.99

New tag.

4:36 PM Changeset in webkit [196532] by Ryan Haddad

3 edits in trunk/Source/WebCore

Reset results for bindings tests after r196520

Unreviewed test gardening.

No new tests needed.

bindings/scripts/test/GObject/WebKitDOMTestEventTarget.cpp:

(webkit_dom_test_event_target_dispatch_event):

bindings/scripts/test/GObject/WebKitDOMTestNode.cpp:

(webkit_dom_test_node_dispatch_event):

4:36 PM Changeset in webkit [196531] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit/mac

Unreviewed, rolling out r196527.
https://bugs.webkit.org/show_bug.cgi?id=154204

"Need to redo as WebCoreThreadViolationCheckRoundThree"
(Requested by mlam on #webkit).

Reverted changeset:

"Add thread violation checks to WebView public APIs."
https://bugs.webkit.org/show_bug.cgi?id=154183
http://trac.webkit.org/changeset/196527

4:32 PM Changeset in webkit [196530] by sbarati@apple.com

2 edits in trunk/Source/WebCore

Attempting build fix from https://bugs.webkit.org/show_bug.cgi?id=154144.

bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::addBuiltinGlobals):

4:30 PM Changeset in webkit [196529] by bshafiei@apple.com

15 edits in branches/safari-601-branch/Source

Merge patch for rdar://problem/24626412.

4:24 PM Changeset in webkit [196528] by dbates@webkit.org

4 edits
4 adds
2 deletes in trunk

CSP: 'blob:' URLs should not match 'self' in CSP source expression lists.
https://bugs.webkit.org/show_bug.cgi?id=153158
<rdar://problem/24383264>

Reviewed by Brent Fulgham.

Source/WebCore:

A blob URL should not match source 'self' by section Security Considerations for GUID URL schemes
of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/CSP2/> (21 July 2015).

Tests: http/tests/security/contentSecurityPolicy/blob-url-does-not-match-source-self.html

http/tests/security/contentSecurityPolicy/blob-url-matches-source-blob.html

page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::matches): Do not make a distinction between URLs that
contain a nested URL (e.g. blob://http://www.example.com/...) and URLs that do not contain a nested
URL. The URL of the requested resource should be matched against the source list source expressions.

LayoutTests:

Add test http/tests/security/contentSecurityPolicy/blob-url-matches-source-blob.html to ensure that a
blob URL matches source "blob:".

Replaced text-only test http/tests/security/contentSecurityPolicy/blob-urls-match-self.html with an
analogous reference test http/tests/security/contentSecurityPolicy/blob-url-does-not-match-source-self.html
so as ensure that we do not regress the behavior that source 'self' should not match a blob URL
without considering the Content Security Policy violation message as part of the expected result.
The Content Security Policy violation message will differ between test runs because it references
the blob URL that triggered the violation, which is cryptographically random.

TestExpectations: Remove entry for test http/tests/security/contentSecurityPolicy/blob-urls-match-self.html as the analogous test

blob-url-does-not-match-source-self.htm now passes.

http/tests/security/contentSecurityPolicy/blob-url-does-not-match-source-self-expected.html: Added.
http/tests/security/contentSecurityPolicy/blob-url-does-not-match-source-self.html: Added.
http/tests/security/contentSecurityPolicy/blob-url-matches-source-blob-expected.txt: Added.
http/tests/security/contentSecurityPolicy/blob-url-matches-source-blob.html: Added.
http/tests/security/contentSecurityPolicy/blob-urls-match-self-expected.txt: Removed.
http/tests/security/contentSecurityPolicy/blob-urls-match-self.html: Removed. See the analogous test blob-url-does-not-match-source-self.html.

4:22 PM Changeset in webkit [196527] by mark.lam@apple.com

2 edits in trunk/Source/WebKit/mac

Add thread violation checks to WebView public APIs.
https://bugs.webkit.org/show_bug.cgi?id=154183

Reviewed by Geoffrey Garen.

This will help clients of the API detect the violations sooner rather than
having to debug mysterious crashes / failures later.

To that end, I've added thread violation checks to the following functions
because ...

WebView/WebView.mm:

(-[WebView setCustomTextEncodingName:]):

Uses the FrameLoader (which is for the main thread only).

(-[WebView stringByEvaluatingJavaScriptFromString:]):

Invokes JavaScript (which is for the main thread only).

(-[WebView windowScriptObject]):

Invokes ScriptController::windowScriptObject() which requires the JSLock.

(-[WebView setGroupName:]):

Manipulates the PageGroup and Page (which is for the main thread only).

(-[WebView setMainFrameURL:]):

Uses the FrameLoader (which is for the main thread only).

(-[WebView mainFrameTitle]):

Uses the FrameLoader::documentLoader() (via [WebFrame _dataSource]) which is RefPtr, and therefore not safe for other threads to access.

(-[WebView mainFrameIcon]):

Uses the FrameLoader::documentLoader() (via [WebFrame _dataSource]) which is RefPtr, and therefore not safe for other threads to access.
Uses [WebIconDatabase sharedIconDatabase] which does a singleton instantiation but is not protected by a lock.

(-[WebView setDrawsBackground:]):

Potentially manipulates a RenderView (via FrameView::setBaseBackgroundColor, via [WebFrame _updateBackgroundAndUpdatesWhileOffscreen]), and RenderView is for main thread only use.

(-[WebView setShouldUpdateWhileOffscreen:]):

Uses [WebFrame _updateBackgroundAndUpdatesWhileOffscreen]. Hence, for the main thread only.

4:18 PM Changeset in webkit [196526] by dbates@webkit.org

34 edits
5 copies
5 adds
4 deletes in trunk

CSP: Implement child-src directive
https://bugs.webkit.org/show_bug.cgi?id=153562
<rdar://problem/24610087>

Reviewed by Brent Fulgham.

Source/WebCore:

Add support for the child-src directive, <https://w3c.github.io/webappsec-csp/2/#child_src> (29 August 2015),
which formally replaces the deprecated frame-src directive as of the Content Security Policy 2.0 spec. The
child-src directive was first introduced in the Content Security Policy 1.1 spec, <https://www.w3.org/TR/2014/WD-CSP11-20140211/>.

As a side effect of this change, the script URL for a Web Worker is checked against the child-src directive
as opposed to the script-src directive. This is a backward incompatible change from the CSP 1.0 spec.

Tests: http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-blocked.html

http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-redirect-blocked.html
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-src-takes-precedence-over-child-src.html
http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked.html
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect.html

loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Check child-src directive (if applicable).

loader/ThreadableLoader.h: Add enum value EnforceChildSrcDirective to enum class ContentSecurityPolicyEnforcement to

enforce the child-src directive on redirect.

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allowChildContextFromSource): Added.

page/csp/ContentSecurityPolicy.h:
page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::ContentSecurityPolicyDirectiveList::checkSourceAndReportViolation): Add message prefix for a child-src violation.
We use the same message prefix as used by Blink.
(WebCore::ContentSecurityPolicyDirectiveList::allowChildContextFromSource): Added.
(WebCore::ContentSecurityPolicyDirectiveList::allowChildFrameFromSource): Modified to check the frame-src
directive (if specified) before checking the child-src directive by <https://w3c.github.io/webappsec-csp/2/#directive-child-src-nested>.
(WebCore::ContentSecurityPolicyDirectiveList::addDirective): Parse the child-src directive.

page/csp/ContentSecurityPolicyDirectiveList.h:
workers/AbstractWorker.cpp:

(WebCore::AbstractWorker::resolveURL): Check if the script URL for the worker is allowed by the child-src directive
as opposed to the script-src directive. This is a backwards incompatible change from the CSP 1.0 spec.

workers/Worker.cpp:

(WebCore::Worker::create): Enforce the child-src directive on redirects (if applicable).

LayoutTests:

Add new tests, un-skip now passing tests and update incorrect expected result for test http/tests/security/contentSecurityPolicy/1.1/child-src/worker-blocked.html.

TestExpectations: Remove entry for test http/tests/security/contentSecurityPolicy/worker-script-src.html as it now passes.

Mark all tests in http/tests/security/contentSecurityPolicy/1.1/child-src as PASS so that we run them except for tests
frame-fires-load-event-when-blocked.html and frame-fires-load-event-when-redirect-blocked.html (formerly named frame-blocked.html
and frame-redirect-blocked.html, respectively) as they depend on the fix for <https://bugs.webkit.org/show_bug.cgi?id=153150>.
Skip all other CSP 1.1 tests until we fix <https://bugs.webkit.org/show_bug.cgi?id=85558>. Group some CSP 1.1 entries together.

fast/workers/worker-inherits-csp-blocks-eval-expected.txt: Update expected result based on change to worker-inherits-csp-blocks-eval.html.
fast/workers/worker-inherits-csp-blocks-eval.html: Remove source 'self' from script-src directive. This was needed as

a workaround for <https://bugs.webkit.org/show_bug.cgi?id=153158> when the script URL for a worker was checked against the
script-src directive. Now that the script URL is checked against the child-src directive we do not need this workaround.

fast/workers/worker-inherits-csp-blocks-xhr.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-about-blank-allowed.html: Use js-test-{pre, post}.js as opposed to

js-test.js to avoid duplicate "TEST COMPLETE" output.

http/tests/security/contentSecurityPolicy/1.1/child-src/frame-allowed.html: Ditto.
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-blocked-expected.txt: Update expected result based on changes to frame-blocked.html.
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-blocked.html: Update test to work without the fix for <https://bugs.webkit.org/show_bug.cgi?id=153150>.

http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-blocked-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/frame-blocked-expected.txt.
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-blocked.html: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/frame-blocked.html.

Keep a copy of the original test for when we fix <https://bugs.webkit.org/show_bug.cgi?id=153150>.

http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-redirect-blocked-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/frame-redirect-blocked-expected.txt.
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-redirect-blocked.html: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/child-src/frame-redirect-blocked.html.

Keep a copy of the original test for when we fix <https://bugs.webkit.org/show_bug.cgi?id=153150>.

http/tests/security/contentSecurityPolicy/1.1/child-src/frame-redirect-blocked-expected.txt: Update expected result based on changes to frame-redirect-blocked.html.
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-redirect-blocked.html: Update test to work without the fix for <https://bugs.webkit.org/show_bug.cgi?id=153150>.
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-src-takes-precedence-over-child-src-expected.txt: Added.
http/tests/security/contentSecurityPolicy/1.1/child-src/frame-src-takes-precedence-over-child-src.html: Added.
http/tests/security/contentSecurityPolicy/1.1/child-src/worker-allowed.html: Use js-test-{pre, post}.js as opposed to

js-test.js to avoid duplicate "TEST COMPLETE" output.

http/tests/security/contentSecurityPolicy/1.1/child-src/worker-blocked-expected.txt: Update incorrect expected result to

reflect WebKit error message. The current result reflects the error message used by Blink.

http/tests/security/contentSecurityPolicy/1.1/child-src/worker-blocked.html: Use js-test-{pre, post}.js as opposed to

js-test.js to avoid duplicate "TEST COMPLETE" output.

http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt: Added.
http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked.html: Added.
http/tests/security/contentSecurityPolicy/1.1/child-src/worker-shared-allowed-expected.txt: Removed; WebKit does not support shared Web Workers.
http/tests/security/contentSecurityPolicy/1.1/child-src/worker-shared-allowed.html: Removed; WebKit does not support shared Web Workers.
http/tests/security/contentSecurityPolicy/1.1/child-src/worker-shared-blocked-expected.txt: Removed; WebKit does not support shared Web Workers.
http/tests/security/contentSecurityPolicy/1.1/child-src/worker-shared-blocked.html: Removed; WebKit does not support shared Web Workers.
http/tests/security/contentSecurityPolicy/resources/child-src-test.js: Remove logic for testing shared Web Workers as WebKit does not support such workers.

(window.onload): Deleted.
(injectSharedWorker): Deleted.

http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-blocks-eval-expected.txt: Update expected result based on change to worker-blob-inherits-csp-blocks-eval.html.
http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-blocks-eval.html: Remove source 'self' from script-src directive.

This was needed as a workaround for <https://bugs.webkit.org/show_bug.cgi?id=153158> when the script URL for a worker was checked
against the script-src directive. Now that the script URL is checked against the child-src directive we do not need this workaround.

http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports-expected.txt: Update

expected result based on change to worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html.

http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html:

Remove source 'self' from script-src directive. This was needed as a workaround for <https://bugs.webkit.org/show_bug.cgi?id=153158> when
the script URL for a worker was checked against the script-src directive. Now that the script URL is checked against the child-src directive
we do not need this workaround.

http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html: Ditto.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html: Add child-src 'none' and remove FIXME comment.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect.html: Added.
platform/ios-simulator/TestExpectations: Remove skip entry for tests in http/tests/security/contentSecurityPolicy/1.1 from this file.

Instead we will skip these tests from LayoutTests/TestExpectations since they fail for all ports.

platform/mac/TestExpectations: Ditto.
platform/win/TestExpectations: Ditto.
platform/wk2/TestExpectations: Ditto.

4:12 PM Changeset in webkit [196525] by sbarati@apple.com

18 edits in trunk/Source

The parser doesn't properly protect against global variable references in builtins
https://bugs.webkit.org/show_bug.cgi?id=154144

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This patch fixes our global variable reference detection
algorithm that was broken. After fixing the algorithm, I
detected many places where we were incorrectly using global
variables. I've fixed all those.

builtins/BuiltinExecutables.cpp:

(JSC::createExecutableInternal):

builtins/NumberPrototype.js:

(toLocaleString):

builtins/PromiseConstructor.js:

(race):
(reject):
(resolve):

parser/Nodes.cpp:

(JSC::ProgramNode::ProgramNode):
(JSC::ModuleProgramNode::ModuleProgramNode):
(JSC::ProgramNode::setClosedVariables): Deleted.

parser/Nodes.h:

(JSC::ScopeNode::setClosedVariables): Deleted.
(JSC::ProgramNode::closedVariables): Deleted.

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::didFinishParsing):

parser/Parser.h:

(JSC::Scope::setIsLexicalScope):
(JSC::Scope::isLexicalScope):
(JSC::Scope::closedVariableCandidates):
(JSC::Scope::declaredVariables):
(JSC::Scope::lexicalVariables):
(JSC::Scope::finalizeLexicalEnvironment):
(JSC::Parser::positionBeforeLastNewline):
(JSC::Parser::locationBeforeLastToken):
(JSC::Parser::isFunctionMetadataNode):
(JSC::parse):
(JSC::Parser::closedVariables): Deleted.

Source/WebCore:

Change JS builtins to no longer reference global variables.

No new tests because old tests cover the issues here.

Modules/mediastream/NavigatorUserMedia.js:

(webkitGetUserMedia):

Modules/mediastream/RTCPeerConnection.js:

(addIceCandidate):
(getStats):

Modules/mediastream/RTCPeerConnectionInternals.js:

(setLocalOrRemoteDescription):

Modules/plugins/QuickTimePluginReplacement.js:

(Replacement.prototype.handleEvent):

Modules/streams/ByteLengthQueuingStrategy.js:

(initializeByteLengthQueuingStrategy):

Modules/streams/CountQueuingStrategy.js:

(initializeCountQueuingStrategy):

Modules/streams/ReadableStreamInternals.js:

(teeReadableStream):

bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::addBuiltinGlobals):

bindings/js/WebCoreBuiltinNames.h:

4:07 PM Changeset in webkit [196524] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

JSObject::putByIndexBeyondVectorLengthWithoutAttributes needs to go to the sparse map based on MAX_STORAGE_VECTOR_INDEX
https://bugs.webkit.org/show_bug.cgi?id=154201
rdar://problem/24291387

Reviewed by Saam Barati.

I decided against adding a test for this, because it runs for a very long time.

runtime/JSObject.cpp:

(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes): Fix the bug.

runtime/StringPrototype.cpp:

(JSC::stringProtoFuncSplit): Fix a related bug: if this code creates an array that would have

hit the above bug, then it would probably manifest as a spin or as swapping.

4:06 PM Changeset in webkit [196523] by Ryan Haddad

3 edits in trunk/LayoutTests

Re-enable skipped animations tests on ios-simulator.
https://bugs.webkit.org/show_bug.cgi?id=152131

Unreviewed test gardening.

platform/ios-simulator-wk2/TestExpectations:
platform/ios-simulator/TestExpectations:

3:34 PM Changeset in webkit [196522] by Jon Davis

2 edits in trunk/Source/JavaScriptCore

Add WebAssembly to the status page
https://bugs.webkit.org/show_bug.cgi?id=154199

Reviewed by Timothy Hatcher.

features.json:

3:33 PM Changeset in webkit [196521] by rniwa@webkit.org

10 edits
2 adds in trunk/Websites/perf.webkit.org

Perf dashboard should allow renaming analysis tasks and test groups
https://bugs.webkit.org/show_bug.cgi?id=154200

Reviewed by Chris Dumez.

Allow editing names of analysis tasks and A/B testing groups in the v3 UI.

Added the support for updating the name to the privileged API at /privileged-api/update-analysis-task
and added a new prevailed API to update A/B testing groups at /privileged-api/update-test-group.

public/privileged-api/update-analysis-task.php: Added the support for renaming the analysis task.

(main):

public/privileged-api/update-test-group.php: Added. Supports updating the test group's name.

(main):

public/v3/components/editable-text.js: Added.

(EditableText): Added. A new editable text label control. It looks like a text node with "(Edit)" link
at the end which allow users to go into the "editing mode", which reveals an input element.
The user can exit the editing mode by either moving the focus away from the control or clicking on
"(Save)" at the end. It calls _updateCallback in the latter case.
(EditableText.prototype.editedText): Returns the current value of the input element user.
(EditableText.prototype.setText): Sets the label. This does not live-update the input element until
the user exists the current editing mode and re-enters it.
(EditableText.prototype.setStartedEditingCallback): Sets a callback which gets called when the user
requested to enter the editing mode. Since EditableText relies on AnalysisTaskPage to render, this
callback only exits to call EditableText.render() in AnalysisTask._didStartEditingTaskName.
(EditableText.prototype.setUpdateCallback): Sets a callback which gets called when the user exits
the editing mode by activating the "(Save)" link. This callback MUST return a promise upon resolution
of which the control gets out of the editing mode. While the promise is in flight, the input element
becomes readonly.
(EditableText.prototype.render): Updates various states of the elements. When _updatingPromise is not
falsy, we make the input element readonly and show '(...)' on the link. Don't show the action link
if the label is empty (e.g. analysis task or test group is still being fetched).
(EditableText.prototype._didClick): Called when the user clicked on the action link. Enter the editing
mode or save the edited label via _updateCallback.
(EditableText.prototype._didBlur): Exit the editing mode without saving if the input element is not
focused, there is no inflight promise returned by _updateCallback, and the action link "(Save)" does
not have the focus.
(EditableText.prototype._didUpdate): Called when exiting the editing mode.
(EditableText.htmlTemplate):
(EditableText.cssTemplate):

public/v3/index.html: Include newly added editable-text.js.

public/v3/models/analysis-task.js:

(AnalysisTask.prototype.updateSingleton): Added.
(AnalysisTask.prototype.updateName): Added. Uses PrivilegedAPI to update the name and re-fetches
the analysis task from the sever.
(AnalysisTask._constructAnalysisTasksFromRawData): Use ensureSingleton instead of manually calling
findById since we need to update the name of the singleton object we found (via updateSingleton).

public/v3/models/bug.js:

(Bug.ensureSingleton): Moved the code to compute the synthetic id from AnalysisTask's
_constructAnalysisTasksFromRawData.
(Bug.prototype.updateSingleton): Added. Just assert that nothing changes.

public/v3/models/build-request.js:

(BuildRequest.prototype.updateSingleton): Added. Assert that the intrinsic values of a build request
doesn't change and update status text, status url, and build id as they could change.

public/v3/models/commit-log.js:

(CommitLog): Made the constructor argument conform to the convention of id, object pair so that we can
use DataModelObject.ensureSingleton.
(CommitLog.ensureSingleton):
(CommitLog.prototype.updateSingleton): Extracted from CommitLog.ensureSingleton.

public/v3/models/data-model.js:

(DataModelObject.ensureSingleton): Call newly added updateSingleton.
(DataModelObject.prototype.updateSingleton):
(LabeledObject): Removed the name map since it's never used (findByName is never called anywhere).
(LabeledObject.prototype.updateSingleton): Added. Updates _name.
(LabeledObject.findByName): Deleted.

public/v3/models/test-group.js:

(TestGroup.prototype.updateName): Added. Uses PrivilegedAPI to update the name and re-fetches
the test group from the sever.
(TestGroup._createModelsFromFetchedTestGroups): Removed bogus code. A root set doesn't have a test
group associated with it since multiple test groups can share a single root set (this property doesn't
even exist).

public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage): Removed useless _taskId and added this._testGroupLabelMap and this._taskNameLabel.
(AnalysisTaskPage.prototype.updateFromSerializedState): Cleanup.
(AnalysisTaskPage.prototype._didFetchTask): Assert that this function is called exactly once.
(AnalysisTaskPage.prototype.render): Use this._task.id() to show the v2 link. Use EditableText to show
the names of the analysis task and the associated test groups. Hide the overview chart and the list of
test groups (along with the retry/confirm button) when the analysis task failed to fetch. We always
update the names of the analysis task and the associated test groups since they could be updated by
the server.
(AnalysisTaskPage.prototype._didStartEditingTaskName): Added.
(AnalysisTaskPage.prototype._updateTaskName): Added.
(AnalysisTaskPage.prototype._updateTestGroupName): Added.
(AnalysisTaskPage.htmlTemplate): Updated the style.

3:25 PM Changeset in webkit [196520] by jiewen_tan@apple.com

27 edits
2 adds in trunk

WebKit should expose the DOM 4 Event.isTrusted property
https://bugs.webkit.org/show_bug.cgi?id=76121
<rdar://problem/22558494>

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

web-platform-tests/dom/events/Event-constructors-expected.txt:
web-platform-tests/dom/events/Event-dispatch-redispatch-expected.txt:
web-platform-tests/dom/events/Event-initEvent-expected.txt:
web-platform-tests/dom/events/ProgressEvent-expected.txt:
web-platform-tests/dom/interfaces-expected.txt:
web-platform-tests/dom/nodes/Document-createEvent-expected.txt:
web-platform-tests/html/dom/interfaces-expected.txt:
web-platform-tests/html/semantics/forms/the-button-element/button-events-expected.txt:

Source/WebCore:

Implements Event.isTrusted. The implementation here is slitely different from and better than
the DOM specification. Here Event.isTrusted will be initialized differently depending on the
callers of the constructors/create methods. If the caller is from user agent, the isTrusted
will be true. Otherwise, it will be false. Since a user agent dispatched event can be catched
and re-initialized/redispatched by the bindings, the flag will be unset at *Event::init*Event
and EventTarget::dispatchEventForBindings. As currently there is no way to let user agent to
dispatch a bindings created event, therefore we ensure that the Event.isTrusted is set for
events dispatched by user agent, and unset for those by bindings.

EventTarget::dispatchEvent(Event*, ExceptionCode&) is renamed to EventTarget::dispatchEventForBindings
in this patch as well. So that, together with the improved design of the API, developers in
the future will be less likely using a wrong dispatchEvent method and setting Event.isTrusted
incorrectly comparing to the DOM design.

After this patch, all events that are created by user agent should be dispatched by
EventTarget::dispatchEvent, and those are created by bindings should be dispatched by
EventTarget::dispatchEventForBindings.

Some of the changes in this patch referred Blink r198996:
https://codereview.chromium.org/1241613004

Test: imported/blink/fast/events/event-trusted.html

bindings/scripts/CodeGeneratorGObject.pm:

(GenerateEventTargetIface):

dom/Event.cpp:

(WebCore::Event::Event):
(WebCore::Event::initEvent):

dom/Event.h:

(WebCore::Event::isTrusted):
(WebCore::Event::setUntrusted):

dom/Event.idl:
dom/EventTarget.cpp:

(WebCore::EventTarget::dispatchEventForBindings):
(WebCore::EventTarget::dispatchEvent): Deleted.

dom/EventTarget.h:
dom/EventTarget.idl:
page/DOMWindow.idl:
page/EventHandler.cpp:

(WebCore::EventHandler::dispatchDragEvent):

workers/WorkerGlobalScope.idl:

Source/WebKit/win:

DOMCoreClasses.cpp:

(DOMNode::dispatchEvent):
(DOMWindow::dispatchEvent):

LayoutTests:

fast/dom/unforgeable-attributes-expected.txt:
fast/xmlhttprequest/xmlhttprequest-get-expected.txt:
http/tests/workers/worker-importScriptsOnError-expected.txt:
imported/blink/fast/events/event-trusted-expected.txt: Added.
imported/blink/fast/events/event-trusted.html: Added.
platform/ios-simulator/TestExpectations:

3:16 PM Changeset in webkit [196519] by beidson@apple.com

6 edits in trunk/Source/WebCore

Modern IDB: IDBObjectStore and IDBIndex need to be ActiveDOMObjects.
https://bugs.webkit.org/show_bug.cgi?id=154153

Reviewed by Alex Christensen.

No new tests (No testable change in behavior).

This is needed so that IDBObjectStore and IDBIndex JS wrappers are not garbage collected
while their IDBTransaction is still in progress.

Modules/indexeddb/client/IDBIndexImpl.cpp:

(WebCore::IDBClient::IDBIndex::IDBIndex):
(WebCore::IDBClient::IDBIndex::activeDOMObjectName):
(WebCore::IDBClient::IDBIndex::canSuspendForDocumentSuspension):
(WebCore::IDBClient::IDBIndex::hasPendingActivity):

Modules/indexeddb/client/IDBIndexImpl.h:

Modules/indexeddb/client/IDBObjectStoreImpl.cpp:

(WebCore::IDBClient::IDBObjectStore::create):
(WebCore::IDBClient::IDBObjectStore::IDBObjectStore):
(WebCore::IDBClient::IDBObjectStore::activeDOMObjectName):
(WebCore::IDBClient::IDBObjectStore::canSuspendForDocumentSuspension):
(WebCore::IDBClient::IDBObjectStore::hasPendingActivity):
(WebCore::IDBClient::IDBObjectStore::index):

Modules/indexeddb/client/IDBObjectStoreImpl.h:

Modules/indexeddb/client/IDBTransactionImpl.cpp:

(WebCore::IDBClient::IDBTransaction::objectStore):
(WebCore::IDBClient::IDBTransaction::createObjectStore):
(WebCore::IDBClient::IDBTransaction::createIndex):

3:01 PM Changeset in webkit [196518] by beidson@apple.com

6 edits
5 adds in trunk

Modern IDB: Simplify the relationship between IDBObjectStore and IDBIndex.
https://bugs.webkit.org/show_bug.cgi?id=154187

Reviewed by Alex Christensen.

Source/WebCore:

Tests: storage/indexeddb/modern/deleteindex-3-private.html

storage/indexeddb/modern/deleteindex-3.html

Instead of allowing IDBIndex to have two different lifecycle modes, it is now always
owned by an IDBObjectStore.

To support the case where an IDBIndex is deleted from its IDBObjectStore, the object
store simply hangs on to deleted indexes until it is destroyed itself.

Modules/indexeddb/client/IDBIndexImpl.cpp:

(WebCore::IDBClient::IDBIndex::markAsDeleted):
(WebCore::IDBClient::IDBIndex::ref):
(WebCore::IDBClient::IDBIndex::deref):

Modules/indexeddb/client/IDBIndexImpl.h:

Modules/indexeddb/client/IDBObjectStoreImpl.cpp:

(WebCore::IDBClient::IDBObjectStore::deleteIndex):

Modules/indexeddb/client/IDBObjectStoreImpl.h:

LayoutTests:

storage/indexeddb/modern/deleteindex-3-expected.txt: Added.
storage/indexeddb/modern/deleteindex-3-private-expected.txt: Added.
storage/indexeddb/modern/deleteindex-3-private.html: Added.
storage/indexeddb/modern/deleteindex-3.html: Added.
storage/indexeddb/modern/resources/deleteindex-3.js: Added.

2:44 PM Changeset in webkit [196517] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Rename domAgent to domTreeManager in DOMNode
https://bugs.webkit.org/show_bug.cgi?id=154194

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-12
Reviewed by Timothy Hatcher.

UserInterface/Models/DOMNode.js:

(WebInspector.DOMNode):

2:37 PM Changeset in webkit [196516] by jmarcell@apple.com

2 edits in trunk/Tools

Open source bot watcher's dashboard fails assertion in BuildbotQueue.prototype.compareIterationsByRevisions
https://bugs.webkit.org/show_bug.cgi?id=154180

Reviewed by Alexey Proskuryakov.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/Dashboard.js: Remove reference to Internal

repository.

2:35 PM Changeset in webkit [196515] by BJ Burg

8 edits in trunk/Source/JavaScriptCore

Web Inspector: disambiguate the various identifier and connection types in RemoteInspector
https://bugs.webkit.org/show_bug.cgi?id=154130

Reviewed by Joseph Pecoraro.

There are multiple identifier types:

connection identifier, a string UUID for a remote debugger process.
session identifier, a string UUID for a remote driver/debugger instance.
page/target identifier, a number unique within a single process.

There are multiple connection types:

RemoteInspectorXPCConnection, a connection from RemoteInspectorXPCConnectionor to a relay.
RemoteConnectionToTarget, a class that bridges to targets' dispatch queues.

Use consistent variable and getter names so that these don't get confused and
so that the code is easier to read. This is especially an improvement when working
with multiple target types or connection types within the same function.

inspector/remote/RemoteConnectionToTarget.h:
inspector/remote/RemoteConnectionToTarget.mm:

Remove the member for m_identifier since we can ask the target for its target identifier
or use a default value via WTF::Optional. There's no reason to cache the value.

(Inspector::RemoteTargetHandleRunSourceWithInfo):
(Inspector::RemoteConnectionToTarget::targetIdentifier):
(Inspector::RemoteConnectionToTarget::destination):
(Inspector::RemoteConnectionToTarget::setup):
(Inspector::RemoteConnectionToTarget::sendMessageToFrontend):
Bail out if the target pointer was somehow cleared and we can't get a useful target identifier.

(Inspector::RemoteConnectionToTarget::RemoteConnectionToTarget): Deleted.

inspector/remote/RemoteControllableTarget.h:
inspector/remote/RemoteInspectionTarget.cpp:

(Inspector::RemoteInspectionTarget::pauseWaitingForAutomaticInspection):
(Inspector::RemoteInspectionTarget::unpauseForInitializedInspector):

inspector/remote/RemoteInspector.h:
inspector/remote/RemoteInspector.mm:

(Inspector::RemoteInspector::nextAvailableTargetIdentifier):
(Inspector::RemoteInspector::registerTarget):
(Inspector::RemoteInspector::unregisterTarget):
(Inspector::RemoteInspector::updateTarget):
(Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
(Inspector::RemoteInspector::sendAutomaticInspectionCandidateMessage):
(Inspector::RemoteInspector::sendMessageToRemote):
(Inspector::RemoteInspector::setupFailed):
(Inspector::RemoteInspector::setupCompleted):
(Inspector::RemoteInspector::stopInternal):
(Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
(Inspector::RemoteInspector::xpcConnectionFailed):
(Inspector::RemoteInspector::listingForInspectionTarget):
(Inspector::RemoteInspector::listingForAutomationTarget):
(Inspector::RemoteInspector::pushListingsNow):
(Inspector::RemoteInspector::pushListingsSoon):
(Inspector::RemoteInspector::updateHasActiveDebugSession):
(Inspector::RemoteInspector::receivedSetupMessage):
(Inspector::RemoteInspector::receivedDataMessage):
(Inspector::RemoteInspector::receivedDidCloseMessage):
(Inspector::RemoteInspector::receivedIndicateMessage):
(Inspector::RemoteInspector::receivedProxyApplicationSetupMessage):
(Inspector::RemoteInspector::receivedConnectionDiedMessage):
(Inspector::RemoteInspector::receivedAutomaticInspectionRejectMessage):
(Inspector::RemoteInspector::nextAvailableIdentifier): Deleted.

inspector/remote/RemoteInspectorConstants.h:

2:34 PM Changeset in webkit [196514] by Beth Dakin

2 edits in trunk/Source/WebKit2

REGRESSION: Link preview is slow and unreliable
https://bugs.webkit.org/show_bug.cgi?id=154197
-and corresponding-
rdar://problem/24428064

Reviewed by Tim Horton.

This patch rolls http://trac.webkit.org/changeset/187471 back in. That was
how we fixed this problem ages ago. We rolled it out because it very
mysteriously seemed to cause a memory regression, but we want to track that
separately and not leave this performance regression in its place in the
meantime.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::updateViewState):
(WebKit::WebPageProxy::dispatchViewStateChange):
(WebKit::WebPageProxy::updateActivityToken):

2:32 PM Changeset in webkit [196513] by benjamin@webkit.org

18 edits in trunk/Source/JavaScriptCore

[JSC] On x86, improve the selection of which value are selected for the UseDef part of commutative operations
https://bugs.webkit.org/show_bug.cgi?id=154151

Reviewed by Filip Pizlo.

Previously, when an instruction destroy an argument with
a UseDef use, we would try to pick a good target for the UseDef
while doing instruction selection.

For example:

@x = Add(@1, @2)

can be lowered to:

Move @1 Tmp3
Add @2 Tmp3

Move @2 Tmp3
Add @1 Tmp3

The choice of which value ends up copied is done by preferRightForResult()
at lowering time.

There are two common problems with the code we generate:
1) It is based on UseCount. If a value is at its last use,

it is a good target for coalescing even with a use-count > 1.

2) When both values are at their last use, the best choice

depends on the register pressure of each. We don't have that information
until we do register allocation.

This patch implements a simple idea to minimize how many of those Moves are needed.
Each commutative operation gets a 3 op variant. The register allocator then attempts
to alias *both* of them to the destination.
Since our aliasing is conservative, it removes as many copy as possible without causing
spilling.

There was an unexpected cool impovement too. If you have:

Move Tmp1, Tmp2
BranchAdd32 Tmp3, Tmp2

we would previously restore Tmp2 by substracting Tmp3 from the result.
We can now just use Tmp1. That removes quite a few Sub from the slow paths.

The problem is that simple idea uncoverred a bunch of issues that had to be fixed too.
I detail them inline below.

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::and64):

assembler/MacroAssemblerX86Common.h:

Most addition are adding an Address version of the 3 operands opcodes.
The reason for this is allow the complex addressing forms of instructions
when spilling.

(JSC::MacroAssemblerX86Common::and32):
(JSC::MacroAssemblerX86Common::mul32):
(JSC::MacroAssemblerX86Common::or32):
(JSC::MacroAssemblerX86Common::xor32):
(JSC::MacroAssemblerX86Common::moveDouble):
This was an unexpected discovery: removing tons of Move32 made floating-point heavy
code much slower.

It turns out the MoveDouble we were using has partial register dependencies.

The x86 optimization manual, Chapter 3, section 3.4.1.13 lists the move instructions executed
directly on the frontend. That's what we use now.

(JSC::MacroAssemblerX86Common::addDouble):
(JSC::MacroAssemblerX86Common::addFloat):
(JSC::MacroAssemblerX86Common::mulDouble):
(JSC::MacroAssemblerX86Common::mulFloat):
(JSC::MacroAssemblerX86Common::andDouble):
(JSC::MacroAssemblerX86Common::andFloat):
(JSC::MacroAssemblerX86Common::xorDouble):
(JSC::MacroAssemblerX86Common::xorFloat):
If the destination is not aliased, the version taking an address
use LoadFloat/LoadDouble instead of direct addressing.

That is because this:

Move Tmp1, Tmp2
Op [Tmp3], Tmp2

is slower than

Move [Tmp3] Tmp2
Op Tmp1, Tmp2

(sometimes significantly).

I am not exactly sure why.

(JSC::MacroAssemblerX86Common::branchAdd32):

assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::and64):

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::and64):

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::and32):
(JSC::MacroAssemblerX86Common::mul32):
(JSC::MacroAssemblerX86Common::or32):
(JSC::MacroAssemblerX86Common::xor32):
(JSC::MacroAssemblerX86Common::moveDouble):
(JSC::MacroAssemblerX86Common::addDouble):
(JSC::MacroAssemblerX86Common::addFloat):
(JSC::MacroAssemblerX86Common::mulDouble):
(JSC::MacroAssemblerX86Common::mulFloat):
(JSC::MacroAssemblerX86Common::andDouble):
(JSC::MacroAssemblerX86Common::andFloat):
(JSC::MacroAssemblerX86Common::xorDouble):
(JSC::MacroAssemblerX86Common::xorFloat):
(JSC::MacroAssemblerX86Common::branchAdd32):

assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::and64):
(JSC::MacroAssemblerX86_64::mul64):
(JSC::MacroAssemblerX86_64::xor64):
(JSC::MacroAssemblerX86_64::branchAdd64):

assembler/X86Assembler.h:

(JSC::X86Assembler::movapd_rr):
(JSC::X86Assembler::movaps_rr):

b3/B3CheckSpecial.cpp:

(JSC::B3::CheckSpecial::shouldTryAliasingDef):
(JSC::B3::CheckSpecial::generate):

b3/B3CheckSpecial.h:
b3/B3LowerToAir.cpp:

(JSC::B3::Air::LowerToAir::lower):

b3/air/AirCustom.h:

(JSC::B3::Air::PatchCustom::shouldTryAliasingDef):

b3/air/AirInst.h:
b3/air/AirInstInlines.h:

(JSC::B3::Air::Inst::shouldTryAliasingDef):

b3/air/AirIteratedRegisterCoalescing.cpp:

Aliasing the operands is done the same way as any coalescing.

There were problem with considering all those coalescing
as equivalent for the result.

Moves are mostly generated for Upsilon-Phis. Getting rid of
those tends to give better loops.

Sometimes, blocks have only Phis and a Jump. Coalescing
those moves gets rids of the block entirely.

Where it go interesting was that something like:

Move Tmp1, Tmp2
Op Tmp3, Tmp2

was significantly better than:

Op Tmp1, Tmp3
Move Tmp1, Tmp4

even in the same basic block.

To get back to the same performance when, I had to prioritize
regular Moves operations over argument coalescing.

Another argument for doing this is that the alias has a shorter
life in the hardware because the operation itself gets a new
virtual register from the bank.

b3/air/AirOpcode.opcodes:
b3/air/AirSpecial.cpp:

(JSC::B3::Air::Special::shouldTryAliasingDef):

b3/air/AirSpecial.h:
b3/testb3.cpp:

(JSC::B3::testCheckAddArgumentAliasing64):
(JSC::B3::testCheckAddArgumentAliasing32):
(JSC::B3::testCheckAddSelfOverflow64):
(JSC::B3::testCheckAddSelfOverflow32):
(JSC::B3::testCheckMulArgumentAliasing64):
(JSC::B3::testCheckMulArgumentAliasing32):
(JSC::B3::run):

dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::reifyInlinedCallFrames):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitSaveOrCopyCalleeSavesFor):
This ruined my week.

When regenerating the frame of an inlined function that
was called through a tail call, we were ignoring r13 for some reason.

Since this patch makes it more likely to increase the degree
of each Tmp, the number of register used increased and r13 was more
commonly used.

When getting out of OSRExit, we would have that value trashed :(

The fix is simply to restore it like the other two Baseline callee saved
register.

2:31 PM Changeset in webkit [196512] by commit-queue@webkit.org

4 edits in trunk/Source/WebInspectorUI

Web Inspector: Avoid including ESLint until it is used
https://bugs.webkit.org/show_bug.cgi?id=154196

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-12
Reviewed by Timothy Hatcher.

Scripts/copy-user-interface-resources.pl:

Do not include ESLint in optimized output yet.

UserInterface/Controllers/AnalyzerManager.js:

Do not reference eslint until we use it.

UserInterface/Main.html:

Remove include to ESLint until we need it.

2:30 PM Changeset in webkit [196511] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Get rid of a 6 year old compiler workaround
https://bugs.webkit.org/show_bug.cgi?id=154198

Reviewed by Sam Weinig.

UIProcess/Launcher/mac/ProcessLauncherMac.mm:

(WebKit::connectToService):
(WebKit::createService):

2:22 PM Changeset in webkit [196510] by mmaxfield@apple.com

12 edits
3 adds in trunk/Source/WebCore

[CSS Font Loading] Implement CSSFontFace Boilerplate
https://bugs.webkit.org/show_bug.cgi?id=154145

Reviewed by Dean Jackson.

The CSS Font Loading spec[1] dictates that the FontFace object needs to have string
accessors and mutators for a bunch of properties. Our CSSFontFace object currently
contains this parsed information, but it isn't accessible via string-based methods.
This patch adds the necessary accessors and mutators, and migrates CSSFontSelector
to use these mutators where necessary.

There is more work to come on CSSFontFace; the next step is to create an .idl file
and hook it up to our CSSFontFace object. In this patch I have left some
unimplemented pieces (for example: where the spec dictates that some operation should
throw a JavaScript exception) which will be implemented in a follow-up patch. This
patch does not have any visible behavior change; I'm separating out the boilerplate
into this patch in order to ease reviewing burden.

This patch separates the externally-facing JavaScript API into a new class, FontFace.
This class owns a CSSFontFace, which provides the backing implementation. There will
be a system of shared ownership of these objects once FontFaceSet is implemented.

No new tests because there is no behavior change.

CMakeLists.txt: Add new files to CMake builds.
WebCore.vcxproj/WebCore.vcxproj: Ditto for Windows.
WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
WebCore.xcodeproj/project.pbxproj: Ditto for Cocoa.
css/CSSAllInOne.cpp: Ditto for All-In-One builds.
css/CSSFontFace.cpp: Move shared code from CSSFontSelector into CSSFontFace.

(WebCore::CSSFontFace::CSSFontFace):
(WebCore::CSSFontFace::~CSSFontFace):
(WebCore::CSSFontFace::setFamilies):
(WebCore::CSSFontFace::setStyle):
(WebCore::CSSFontFace::setWeight):
(WebCore::CSSFontFace::setUnicodeRange):
(WebCore::CSSFontFace::setVariantLigatures):
(WebCore::CSSFontFace::setVariantPosition):
(WebCore::CSSFontFace::setVariantCaps):
(WebCore::CSSFontFace::setVariantNumeric):
(WebCore::CSSFontFace::setVariantAlternates):
(WebCore::CSSFontFace::setVariantEastAsian):
(WebCore::CSSFontFace::setFeatureSettings):

css/CSSFontFace.h: Clean up.

(WebCore::CSSFontFace::create):
(WebCore::CSSFontFace::families):
(WebCore::CSSFontFace::traitsMask):
(WebCore::CSSFontFace::featureSettings):
(WebCore::CSSFontFace::variantSettings):
(WebCore::CSSFontFace::setVariantSettings):
(WebCore::CSSFontFace::setTraitsMask):
(WebCore::CSSFontFace::isLocalFallback):
(WebCore::CSSFontFace::addRange): Deleted.
(WebCore::CSSFontFace::insertFeature): Deleted.
(WebCore::CSSFontFace::setVariantCommonLigatures): Deleted.
(WebCore::CSSFontFace::setVariantDiscretionaryLigatures): Deleted.
(WebCore::CSSFontFace::setVariantHistoricalLigatures): Deleted.
(WebCore::CSSFontFace::setVariantContextualAlternates): Deleted.
(WebCore::CSSFontFace::setVariantPosition): Deleted.
(WebCore::CSSFontFace::setVariantCaps): Deleted.
(WebCore::CSSFontFace::setVariantNumericFigure): Deleted.
(WebCore::CSSFontFace::setVariantNumericSpacing): Deleted.
(WebCore::CSSFontFace::setVariantNumericFraction): Deleted.
(WebCore::CSSFontFace::setVariantNumericOrdinal): Deleted.
(WebCore::CSSFontFace::setVariantNumericSlashedZero): Deleted.
(WebCore::CSSFontFace::setVariantAlternates): Deleted.
(WebCore::CSSFontFace::setVariantEastAsianVariant): Deleted.
(WebCore::CSSFontFace::setVariantEastAsianWidth): Deleted.
(WebCore::CSSFontFace::setVariantEastAsianRuby): Deleted.
(WebCore::CSSFontFace::CSSFontFace): Deleted.

css/CSSFontSelector.cpp: Migrate shared code into CSSFontFace, and udpate

to use the new API.
(WebCore::appendSources):
(WebCore::registerLocalFontFacesForFamily):
(WebCore::CSSFontSelector::addFontFaceRule):
(WebCore::computeTraitsMask): Deleted.
(WebCore::createFontFace): Deleted.

css/FontFace.cpp: Added. External JavaScript API. Owns a CSSFontFace.

(WebCore::FontFace::FontFace):
(WebCore::FontFace::~FontFace):
(WebCore::parseString):
(WebCore::FontFace::setFamily):
(WebCore::FontFace::setStyle):
(WebCore::FontFace::setWeight):
(WebCore::FontFace::setStretch):
(WebCore::FontFace::setUnicodeRange):
(WebCore::FontFace::setVariant):
(WebCore::FontFace::setFeatureSettings):
(WebCore::FontFace::family):
(WebCore::FontFace::style):
(WebCore::FontFace::weight):
(WebCore::FontFace::stretch):
(WebCore::FontFace::unicodeRange):
(WebCore::FontFace::variant):
(WebCore::FontFace::featureSettings):

css/FontFace.h: Added. Ditto.

(WebCore::FontFace::create):

css/FontVariantBuilder.cpp: Added. Moved code here from FontVariantBuilder.h.

Refactored to support a new client (CSSFontFace).
(WebCore::extractFontVariantLigatures):
(WebCore::extractFontVariantNumeric):
(WebCore::extractFontVariantEastAsian):
(WebCore::computeFontVariant):

css/FontVariantBuilder.h: Moved code from here into FontVariantBuilder.cpp.

(WebCore::applyValueFontVariantLigatures): Deleted.
(WebCore::applyValueFontVariantNumeric): Deleted.
(WebCore::applyValueFontVariantEastAsian): Deleted.

css/StyleBuilderCustom.h: Update for new FontVariantBuilder API.

(WebCore::StyleBuilderCustom::applyValueFontVariantLigatures):
(WebCore::StyleBuilderCustom::applyValueFontVariantNumeric):
(WebCore::StyleBuilderCustom::applyValueFontVariantEastAsian):

platform/text/TextFlags.h: Provide convenience classes.

(WebCore::FontVariantLigaturesValues::FontVariantLigaturesValues):
(WebCore::FontVariantNumericValues::FontVariantNumericValues):
(WebCore::FontVariantEastAsianValues::FontVariantEastAsianValues):

2:17 PM Changeset in webkit [196509] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

Build fix after r196506; publish MediaResourceLoader.h as a private header so it can be used by
TestWebKitAPI.

WebCore.xcodeproj/project.pbxproj:

2:15 PM Changeset in webkit [196508] by commit-queue@webkit.org

4 edits in trunk/Source/WebInspectorUI

Web Inspector: Tabs: Conflicts with multiple Formatters per SourceCode
https://bugs.webkit.org/show_bug.cgi?id=144717
<rdar://problem/20845163>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-12
Reviewed by Timothy Hatcher.

The underlying issue here is that each tab may create its own ContentView,
and therefore SourceCodeTextEditor, per-SourceCode. Each SourceCodeTextEditor
was mutating the SourceCode's state without listening for or expecting
updates from the other. This causes a bunch of different issues:

editing in one tab does not get reflected in another tab for the same resource. This is common when using the Search tab to find and make an edit, then debug in another tab.

one tab may auto format (pretty print) a resource and set the formatter on the SourceCode to make SourceCodeLocations know about formatted locations. However, a jump to location that opens a new ContentView for the same Resource will start out un-formatted, and misunderstand the location. This often results in an unexpected jump to 0:0.

The solution taken by this change is to have a single ContentView
per represented object. When that ContentView gets shown in a new
ContentViewContainer it gets transferred, leaving a tombstone in the
previous ContentViewContainer that can be revived later. This keeps
back foward lists with expected values. It also means there is a
single ContentView that doesn't need to worry about having the
state of its represented object getting overrun.

Currently this makes the assumption that we won't ever show multiple
ContentViews for the same represented object at the same time. This
may need to change if we were to support split pane editor or
something like that.

This also makes the assumption that ContentViewContainer's showEntry
and hideEntry do not modify the back forward list. That has not been
the case, and I think it is safe to assume it will never be the case.

The contracts this patch maintains:

a ContentView is always owned by one ViewContainer. This ViewContainer is the one showing the ContentView.

when another ViewContainer wants to share the ContentView ownership is transferred. Creating tombstones in the old ViewContainer and Reviving tombstones in the new ViewContainer.

ViewContainer's have a tombstone per-BackForwardEntry that references the ContentView.

In order to ensure a ContentView always gets closed, when the owning ViewContainer would close the ContentView it checks if it should instead transfer ownership of the ContentView to another interested ViewContainer.

This also maintains the contract that a ContentView should only be
closed once. When the ContentView is transferred between two
ContentViewContainers it should hide/show from the old to the new.
The last ContentViewContainer to reference a ContentView should
be the one to close the ContentView.

UserInterface/Models/BackForwardEntry.js:

(WebInspector.BackForwardEntry):
(WebInspector.BackForwardEntry.prototype.get tombstone):
(WebInspector.BackForwardEntry.prototype.set tombstone):
(WebInspector.BackForwardEntry.prototype.prepareToShow):
(WebInspector.BackForwardEntry.prototype.prepareToHide):
Tombstone state and assertions that we don't show/hide tombstones,
that should all be done before a back forward entry has become a tombstone.

UserInterface/Views/ContentView.js:

(WebInspector.ContentView.contentViewForRepresentedObject):
(WebInspector.ContentView.closedContentViewForRepresentedObject):
(WebInspector.ContentView.resolvedRepresentedObjectForRepresentedObject):
Helpers for getting / creating / clearing the single ContentView that
is associated with a represented object.

UserInterface/Views/ContentViewContainer.js:

(WebInspector.ContentViewContainer.prototype.contentViewForRepresentedObject):
(WebInspector.ContentViewContainer.prototype.showContentView):
Eliminate code that dealt with multiple content views per represented object.
That is replaced by multiple ContentViewContainers per ContentView.

(WebInspector.ContentViewContainer.prototype.replaceContentView):
This is called in special places where we don't need to worry about a tombstone.
It is an in replace of a content view.

(WebInspector.ContentViewContainer.closeAllContentViewsOfPrototype):
(WebInspector.ContentViewContainer.prototype.closeContentView):
(WebInspector.ContentViewContainer.prototype.closeAllContentViews):
(WebInspector.ContentViewContainer.prototype._disassociateFromContentView):
Deal with closing BackForwardEntrys that are tombstones.

(WebInspector.ContentViewContainer.prototype._takeOwnershipOfContentView):
(WebInspector.ContentViewContainer.prototype._placeTombstonesForContentView):
(WebInspector.ContentViewContainer.prototype._clearTombstonesForContentView):
Helpers for transfering ownership of a ContentView to a ContentViewContainer.
There is always one owner of the ContentView. Non-owners have tombstone
BackForward entries.

(WebInspector.ContentViewContainer.prototype._showEntry):
If we are showing a tombstone, gain ownership.

(WebInspector.ContentViewContainer.prototype._hideEntry):
This may happen in closing, for simplicity we bail here instead of include
messy logic at the call site. We would have already hidden this entry
when making it a tombstone.

2:13 PM Changeset in webkit [196507] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Fix ASan build.

UIProcess/Launcher/mac/ProcessLauncherMac.mm:

(WebKit::copyASanDynamicLibraryPath): Deleted.

2:13 PM Changeset in webkit [196506] by jer.noble@apple.com

7 edits in trunk

[Mac] Adopt MediaResourceLoader (instead of CachedResourceLoader) in WebCoreNSURLSession.
https://bugs.webkit.org/show_bug.cgi?id=154136

Reviewed by Alex Christensen.

Source/WebCore:

MediaResourceLoader already supports using CORS attribute to verify CORS access requirements
when loading media resources, so use it, rather than CachedResourceLoader, as the backing for
WebCoreNSURLSession.

platform/network/cocoa/WebCoreNSURLSession.h:
platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession delegateQueue]):
(-[WebCoreNSURLSession streamTaskWithNetService:]):
(-[WebCoreNSURLSession isKindOfClass:]):
(-[WebCoreNSURLSessionDataTask initWithSession:identifier:request:]):
(-[WebCoreNSURLSessionDataTask _restart]):
(-[WebCoreNSURLSessionDataTask _cancel]):
(-[WebCoreNSURLSessionDataTask resume]):
(-[WebCoreNSURLSessionDataTask _timingData]):
(-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):
(-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):
(-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]): Deleted.
(-[WebCoreNSURLSession loader]): Deleted.
(WebCore::WebCoreNSURLSessionDataTaskClient::dataSent): Deleted.
(WebCore::WebCoreNSURLSessionDataTaskClient::responseReceived): Deleted.
(WebCore::WebCoreNSURLSessionDataTaskClient::dataReceived): Deleted.
(WebCore::WebCoreNSURLSessionDataTaskClient::redirectReceived): Deleted.
(WebCore::WebCoreNSURLSessionDataTaskClient::notifyFinished): Deleted.
(-[WebCoreNSURLSessionDataTask initWithSession:identifier:URL:]): Deleted.
(-[WebCoreNSURLSessionDataTask _finish]): Deleted.
(-[WebCoreNSURLSessionDataTask _setDefersLoading:]): Deleted.
(-[WebCoreNSURLSessionDataTask resource:sentBytes:totalBytesToBeSent:]): Deleted.
(-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]): Deleted.
(-[WebCoreNSURLSessionDataTask resourceFinished:]): Deleted.

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):

Tools:

Use a MediaResourceLoader instead of a CachedResourceLoader for WebCoreNSURLSession.

Drive-by fix: generate USE and ENABLE macros for TestWebKitAPI by adding FEATURE_DEFINES
to GCC_PREPROCESSOR_DEFINES.

TestWebKitAPI/Configurations/Base.xcconfig:
TestWebKitAPI/Tests/WebCore/WebCoreNSURLSession.mm:

(TestWebKitAPI::WebCoreNSURLSessionTest::SetUp):
(TestWebKitAPI::WebCoreNSURLSessionTest::TearDown):
(TestWebKitAPI::TEST_F):

2:04 PM Changeset in webkit [196505] by andersca@apple.com

15 edits
3 deletes in trunk/Source/WebKit2

Remove NPAPI for showing preference panes
https://bugs.webkit.org/show_bug.cgi?id=154193

Reviewed by Dan Bernstein.

No plug-ins ended up adopting this API, so there's no point in keeping it around.

PluginProcess/PluginControllerProxy.h:
PluginProcess/mac/PluginControllerProxyMac.mm:

(WebKit::PluginControllerProxy::openPluginPreferencePane): Deleted.

Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:

(WebKit::NetscapePluginModule::getPluginInfo): Deleted.

Shared/Plugins/PluginModuleInfo.h:
UIProcess/Plugins/PluginProcessProxy.h:
UIProcess/Plugins/PluginProcessProxy.messages.in:
UIProcess/Plugins/mac/PluginProcessProxyMac.mm:

(WebKit::PluginProcessProxy::openPluginPreferencePane): Deleted.

WebKit2.xcodeproj/project.pbxproj:
WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:

(WebKit::NPN_GetValue): Deleted.

WebProcess/Plugins/Netscape/NetscapePlugin.h:
WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:

(WebKit::NetscapePlugin::openPluginPreferencePane): Deleted.
(WebKit::NetscapePlugin::plugInContainer): Deleted.
(WebKit::NetscapePlugin::platformDestroy): Deleted.

WebProcess/Plugins/Netscape/mac/WKNPAPIPlugInContainer.h: Removed.
WebProcess/Plugins/Netscape/mac/WKNPAPIPlugInContainer.mm: Removed.

(-[WKNPAPIPlugInContainer dealloc]): Deleted.
(-[WKNPAPIPlugInContainer _invalidate]): Deleted.
(-[WKNPAPIPlugInContainer openPlugInPreferencePane]): Deleted.

WebProcess/Plugins/Netscape/mac/WKNPAPIPlugInContainerInternal.h: Removed.
WebProcess/Plugins/PluginController.h:
WebProcess/Plugins/PluginView.cpp:

(WebKit::PluginView::openPluginPreferencePane): Deleted.

WebProcess/Plugins/PluginView.h:

1:54 PM Changeset in webkit [196504] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.9/Source/WebKit

Merged r196502. rdar://problem/24635219

1:52 PM Changeset in webkit [196503] by achristensen@apple.com

2 edits in trunk/Source/WebCore

Fix non-internal builds when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=152285

platform/spi/cf/CFNetworkSPI.h:

Add SPI declaration used in r194156.

1:43 PM Changeset in webkit [196502] by achristensen@apple.com

2 edits in trunk/Source/WebKit

Fix internal Windows WebKit debug build.
rdar://problem/24635219

PlatformWin.cmake:

We were making WebKit.dll instead of WebKit_debug.dll.

1:39 PM Changeset in webkit [196501] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Remove PowerPC cruft
https://bugs.webkit.org/show_bug.cgi?id=154191

Reviewed by Dan Bernstein.

Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:

(WebKit::getPluginArchitecture): Deleted.

1:25 PM Changeset in webkit [196500] by andersca@apple.com

11 edits
1 delete in trunk/Source/WebKit2

Remove more unneeded process launching code
https://bugs.webkit.org/show_bug.cgi?id=154190

Reviewed by Tim Horton.

UIProcess/Databases/DatabaseProcessProxy.cpp:

(WebKit::DatabaseProcessProxy::getLaunchOptions): Deleted.

UIProcess/Databases/mac/DatabaseProcessProxyMac.mm: Removed.

(WebKit::DatabaseProcessProxy::platformGetLaunchOptions): Deleted.

UIProcess/Launcher/ProcessLauncher.h:
UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::getLaunchOptions): Deleted.

UIProcess/Network/mac/NetworkProcessProxyMac.mm:

(WebKit::NetworkProcessProxy::platformGetLaunchOptions): Deleted.

UIProcess/Plugins/PluginProcessProxy.h:
UIProcess/Plugins/mac/PluginProcessProxyMac.mm:

(WebKit::PluginProcessProxy::pluginNeedsExecutableHeap): Deleted.
(WebKit::PluginProcessProxy::platformGetLaunchOptions): Deleted.

UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::getLaunchOptions): Deleted.

UIProcess/mac/WebProcessProxyMac.mm:

(WebKit::WebProcessProxy::platformGetLaunchOptions): Deleted.

WebKit2.xcodeproj/project.pbxproj:

1:11 PM Changeset in webkit [196499] by andersca@apple.com

8 edits in trunk/Source/WebKit2

Use different process types for 32-bit and 64-bit plug-ins
https://bugs.webkit.org/show_bug.cgi?id=154186

Reviewed by Tim Horton.

UIProcess/Databases/DatabaseProcessProxy.cpp:

(WebKit::DatabaseProcessProxy::getLaunchOptions):

UIProcess/Launcher/ProcessLauncher.h:
UIProcess/Launcher/mac/ProcessLauncherMac.mm:

(WebKit::serviceName):
(WebKit::shouldLeakBoost):

UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::getLaunchOptions):

UIProcess/Plugins/PluginProcessProxy.cpp:

(WebKit::PluginProcessProxy::getLaunchOptions): Deleted.

UIProcess/Plugins/mac/PluginProcessProxyMac.mm:

(WebKit::PluginProcessProxy::platformGetLaunchOptions):

UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::getLaunchOptions):

12:46 PM Changeset in webkit [196498] by Yusuke Suzuki

20 edits
4 adds in trunk

[ES6] Implement @@search
https://bugs.webkit.org/show_bug.cgi?id=143889

Reviewed by Darin Adler.

Source/JavaScriptCore:

Implement RegExp.prototype[@@search].
In ES6, String.prototype.search delegates the actual matching to it
instead of executing RegExp matching inside String.prototype.search method itself.
By customizing @@search method, we can change the behavior of String.prototype.search for
derived / customized RegExp object.

CMakeLists.txt:
DerivedSources.make:
builtins/BuiltinNames.h:

(JSC::BuiltinNames::BuiltinNames): Deleted.

builtins/BuiltinUtils.h:
builtins/StringPrototype.js:

(search):

bytecode/BytecodeIntrinsicRegistry.cpp:

(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):

bytecode/BytecodeIntrinsicRegistry.h:
runtime/CommonIdentifiers.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

runtime/RegExpPrototype.cpp:

(JSC::RegExpPrototype::finishCreation):
(JSC::regExpProtoFuncSearch):

runtime/RegExpPrototype.h:

(JSC::RegExpPrototype::create):

runtime/StringPrototype.cpp:

(JSC::StringPrototype::getOwnPropertySlot):
(JSC::StringPrototype::finishCreation): Deleted.
(JSC::stringProtoFuncSearch): Deleted.

runtime/StringPrototype.h:
tests/es6.yaml:
tests/stress/regexp-search.js: Added.

(shouldBe):
(shouldThrow):
(errorKey.toString):
(primitive.of.primitives.shouldThrow):
(testRegExpSearch):
(testSearch):
(testBoth):
(alwaysUnmatch):

LayoutTests:

js/Object-getOwnPropertyNames-expected.txt:
js/dom/string-prototype-properties-expected.txt:
js/regress/script-tests/v8-regexp-search.js: Added.

(runRegExpBenchmark.runBlock0):
(runRegExpBenchmark.runBlock1):
(runRegExpBenchmark):
(runRegExpBenchmark.runBlock3):
(runRegExpBenchmark.runBlock4):

js/regress/v8-regexp-search-expected.txt: Added.
js/regress/v8-regexp-search.html: Added.
js/script-tests/Object-getOwnPropertyNames.js:
sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt:

12:44 PM Changeset in webkit [196497] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

AdaptiveInferredPropertyValueWatchpoint can trigger a GC that frees its CodeBlock and thus itself
https://bugs.webkit.org/show_bug.cgi?id=154146

Reviewed by Filip Pizlo.

Consider the following: there is some CodeBlock, C, that is watching some object, O, with a
structure, S, for replacements. Also, suppose that C has no references anymore and is due to
be GCed. Now, when some new property is added to O, S will create a new structure S' and
fire its transition watchpoints. Since C is watching S for replacements it will attempt to
have its AdaptiveInferredPropertyValueWatchpoint relocate itself to S'. To do so, it needs
it allocate RareData on S'. This allocation may cause a GC, which frees C while still
executing its watchpoint handler. The solution to this is to defer GC while running
AdaptiveInferredPropertyValueWatchpointBase handlers.

bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp:

(JSC::AdaptiveInferredPropertyValueWatchpointBase::fire):

12:31 PM Changeset in webkit [196496] by Beth Dakin

5 edits in trunk/Source/WebKit2

Re-name isClickableElement in InteractionInformationAtPosition to isElement
https://bugs.webkit.org/show_bug.cgi?id=154179

Reviewed by Enrica Casucci.

The bool is set for all elements, so it’s just confusing to call it a
clickableElement instead of just element.

Shared/ios/InteractionInformationAtPosition.h:
Shared/ios/InteractionInformationAtPosition.mm:

(WebKit::InteractionInformationAtPosition::encode):
(WebKit::InteractionInformationAtPosition::decode):

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView gestureRecognizerShouldBegin:]):
(-[WKContentView _highlightLongPressRecognized:]):

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::getPositionInformation):

12:22 PM Changeset in webkit [196495] by akling@apple.com

2 edits in trunk/Source/WebCore

Throw out all live resource decoded data on memory pressure / suspension.
<https://webkit.org/b/154176>

Reviewed by Antti Koivisto.

When pruning live resource decoded data from the memory cache,
we normally avoid pruning anything that's been painted in the last second.
This is an optimization to avoid getting into image decoding loops.

For memory pressure / process suspension scenarios this doesn't really
make sense though:

In the pressure case, if we have to render again soon it'll likely be a new GIF frame which we have to decode anyway.

In the process suspension case, we might *never* render again, so we should be good citizens and drop all the decoded data we can.

This patch makes us drop all the decoded data, recently painted or not.

platform/MemoryPressureHandler.cpp:

(WebCore::MemoryPressureHandler::releaseCriticalMemory):

12:20 PM Changeset in webkit [196494] by barraclough@apple.com

6 edits in trunk/Source

Separate out !allowsAccess path in JSDOMWindowCustom getOwnPropertySlot
https://bugs.webkit.org/show_bug.cgi?id=154156

Reviewed by Chris Dumez.

Source/JavaScriptCore:

runtime/CommonIdentifiers.h:
- added new property names, needed by jsDOMWindowGetOwnPropertySlotDisallowAccess.

Source/WebCore:

JSDOMWindowCustom getOwnPropertySlot currently allows cross-origin access to all
static properties, relying on the property to perform the access check. This is
a little insecure, since it is error prone - someone could easily add a property
to the static table without realizing it would be automatcially exposed.

Instead, add a hard-coded filter to restrict access. As a future implementation
we might consider autogenerating this (the properties are already tagged in IDL,
we might be able to track this in a flag on the static table).

By separating out the handling of the same- and cross-origin access we can
simplify & make the policy being enforced much clearer.

bindings/js/JSDOMBinding.cpp:

(WebCore::objectToStringFunctionGetter): Deleted.

removed objectToStringFunctionGetter - this duplicated functionality of nonCachingStaticFunctionGetter.

bindings/js/JSDOMBinding.h:

(WebCore::objectToStringFunctionGetter): Deleted.

removed objectToStringFunctionGetter - this duplicated functionality of nonCachingStaticFunctionGetter.

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::jsDOMWindowGetOwnPropertySlotDisallowAccess):

explicitly handle providing access to only the things we do want to allow cross-origin.

(WebCore::JSDOMWindow::getOwnPropertySlot):
(WebCore::JSDOMWindow::getOwnPropertySlotByIndex):

push all !allowsAccess handling to jsDOMWindowGetOwnPropertySlotDisallowAccess

(WebCore::childFrameGetter): Deleted.

this was just a deoptimiztion - moving access into a callback saved very little & caused more work to be duplicated.

12:17 PM Changeset in webkit [196493] by andersca@apple.com

3 edits in trunk/Source/WebKit2

Remove more unused process launcher code
https://bugs.webkit.org/show_bug.cgi?id=154181

Reviewed by Tim Horton.

UIProcess/Launcher/ProcessLauncher.cpp:

(WebKit::ProcessLauncher::processTypeAsString): Deleted.
(WebKit::ProcessLauncher::getProcessTypeFromString): Deleted.

UIProcess/Launcher/ProcessLauncher.h:

12:15 PM Changeset in webkit [196492] by Sukolsak Sakshuwong

122 edits
2 adds in trunk/Source

Update ICU header files to version 52
https://bugs.webkit.org/show_bug.cgi?id=154160

Reviewed by Alex Christensen.

Update ICU header files to version 52 to allow the use of newer APIs.

Source/JavaScriptCore:

icu/unicode/localpointer.h:
icu/unicode/platform.h:
icu/unicode/ptypes.h:
icu/unicode/putil.h:
icu/unicode/ucal.h:
icu/unicode/uchar.h:
icu/unicode/ucnv.h:
icu/unicode/ucol.h:
icu/unicode/uconfig.h:
icu/unicode/udat.h:
icu/unicode/udatpg.h:
icu/unicode/udisplaycontext.h: Added.
icu/unicode/uenum.h:
icu/unicode/uformattable.h: Added.
icu/unicode/uiter.h:
icu/unicode/uloc.h:
icu/unicode/umachine.h:
icu/unicode/unorm2.h:
icu/unicode/unum.h:
icu/unicode/urename.h:
icu/unicode/uscript.h:
icu/unicode/uset.h:
icu/unicode/ustring.h:
icu/unicode/utf.h:
icu/unicode/utf16.h:
icu/unicode/utf8.h:
icu/unicode/utf_old.h:
icu/unicode/utypes.h:
icu/unicode/uvernum.h:
icu/unicode/uversion.h:

Source/WebCore:

No new tests because there is no behavior change.

icu/unicode/bytestream.h:
icu/unicode/chariter.h:
icu/unicode/localpointer.h:
icu/unicode/platform.h:
icu/unicode/ptypes.h:
icu/unicode/putil.h:
icu/unicode/rep.h:

(Replaceable::Replaceable):

icu/unicode/std_string.h:
icu/unicode/strenum.h:
icu/unicode/stringpiece.h:
icu/unicode/ubrk.h:
icu/unicode/uchar.h:
icu/unicode/ucnv.h:
icu/unicode/ucol.h:
icu/unicode/ucoleitr.h:
icu/unicode/uconfig.h:
icu/unicode/ucsdet.h:
icu/unicode/uenum.h:
icu/unicode/uidna.h:
icu/unicode/uiter.h:
icu/unicode/uloc.h:
icu/unicode/umachine.h:
icu/unicode/unistr.h:

(UnicodeString::UnicodeString):
(UnicodeString::operator== ):
(UnicodeString::startsWith):
(UnicodeString::setTo):
(UnicodeString::remove):
(UnicodeString::replace): Deleted.
(UnicodeString::extract): Deleted.
(UnicodeString::char32At): Deleted.
(UnicodeString::getChar32Start): Deleted.
(UnicodeString::getChar32Limit): Deleted.
(UnicodeString::getTerminatedBuffer): Deleted.
(UnicodeString::append): Deleted.
(UnicodeString::truncate): Deleted.

icu/unicode/unorm2.h:
icu/unicode/uobject.h:
icu/unicode/urename.h:
icu/unicode/uscript.h:
icu/unicode/usearch.h:
icu/unicode/uset.h:
icu/unicode/ushape.h:
icu/unicode/ustring.h:
icu/unicode/utext.h:
icu/unicode/utf.h:
icu/unicode/utf16.h:
icu/unicode/utf8.h:
icu/unicode/utf_old.h:
icu/unicode/utypes.h:
icu/unicode/uvernum.h:
icu/unicode/uversion.h:

Source/WebKit/mac:

icu/unicode/localpointer.h:
icu/unicode/platform.h:
icu/unicode/ptypes.h:
icu/unicode/putil.h:
icu/unicode/uchar.h:
icu/unicode/uconfig.h:
icu/unicode/uidna.h:
icu/unicode/uiter.h:
icu/unicode/umachine.h:
icu/unicode/unorm2.h:
icu/unicode/urename.h:
icu/unicode/uscript.h:
icu/unicode/ustring.h:
icu/unicode/utf.h:
icu/unicode/utf16.h:
icu/unicode/utf8.h:
icu/unicode/utf_old.h:
icu/unicode/utypes.h:
icu/unicode/uvernum.h:
icu/unicode/uversion.h:

Source/WTF:

icu/unicode/bytestream.h:
icu/unicode/localpointer.h:
icu/unicode/platform.h:
icu/unicode/ptypes.h:
icu/unicode/putil.h:
icu/unicode/rep.h:

(Replaceable::Replaceable):

icu/unicode/std_string.h:
icu/unicode/strenum.h:
icu/unicode/stringpiece.h:
icu/unicode/uchar.h:
icu/unicode/ucnv.h:
icu/unicode/ucol.h:
icu/unicode/uconfig.h:
icu/unicode/uenum.h:
icu/unicode/uiter.h:
icu/unicode/uloc.h:
icu/unicode/umachine.h:
icu/unicode/unistr.h:

icu/unicode/unorm2.h:
icu/unicode/uobject.h:
icu/unicode/urename.h:
icu/unicode/uscript.h:
icu/unicode/uset.h:
icu/unicode/ustring.h:
icu/unicode/utf.h:
icu/unicode/utf16.h:
icu/unicode/utf8.h:
icu/unicode/utf_old.h:
icu/unicode/utypes.h:
icu/unicode/uvernum.h:
icu/unicode/uversion.h:

11:58 AM Changeset in webkit [196491] by andersca@apple.com

10 edits in trunk/Source/WebKit2

Remove more unused process launching code
https://bugs.webkit.org/show_bug.cgi?id=154178

Reviewed by Tim Horton.

UIProcess/Databases/mac/DatabaseProcessProxyMac.mm:

(WebKit::shouldUseXPC): Deleted.
(WebKit::DatabaseProcessProxy::platformGetLaunchOptions): Deleted.

UIProcess/Launcher/ProcessLauncher.h:
UIProcess/Launcher/mac/EnvironmentVariables.cpp:

(WebKit::EnvironmentVariables::preexistingProcessServiceNameKey): Deleted.
(WebKit::EnvironmentVariables::preexistingProcessTypeKey): Deleted.

UIProcess/Launcher/mac/EnvironmentVariables.h:
UIProcess/Launcher/mac/ProcessLauncherMac.mm:

(WebKit::ProcessLauncher::launchProcess):
(WebKit::setUpTerminationNotificationHandler): Deleted.
(WebKit::addDYLDEnvironmentAdditions): Deleted.
(WebKit::tryPreexistingProcess): Deleted.
(WebKit::createProcess): Deleted.

UIProcess/Network/mac/NetworkProcessProxyMac.mm:

(WebKit::shouldUseXPC): Deleted.
(WebKit::NetworkProcessProxy::platformGetLaunchOptions): Deleted.

UIProcess/Plugins/mac/PluginProcessProxyMac.mm:

(WebKit::PluginProcessProxy::platformGetLaunchOptions): Deleted.

UIProcess/ios/WebProcessProxyIOS.mm:

(WebKit::WebProcessProxy::platformGetLaunchOptions): Deleted.

UIProcess/mac/WebProcessProxyMac.mm:

(WebKit::shouldUseXPC): Deleted.
(WebKit::WebProcessProxy::platformGetLaunchOptions): Deleted.

11:50 AM Changeset in webkit [196490] by fpizlo@apple.com

3 edits
1 add in trunk/Source/JavaScriptCore

Fast path in JSObject::defineOwnIndexedProperty() forgets to check for the posibility of a descriptor that doesn't have a value
https://bugs.webkit.org/show_bug.cgi?id=154175
rdar://problem/24291497

Reviewed by Geoffrey Garen.

runtime/JSObject.cpp:

(JSC::JSObject::defineOwnIndexedProperty): Fix the bug.

runtime/SparseArrayValueMap.cpp:

(JSC::SparseArrayValueMap::putEntry): Catch the bug sooner in debug.
(JSC::SparseArrayValueMap::putDirect):

tests/stress/sparse-define-empty-descriptor.js: Added. This used to crash in release.

11:43 AM Changeset in webkit [196489] by Beth Dakin

4 edits in trunk/Source/WebKit/mac

NSRangeIsRelativeTo should not have NS prefix
https://bugs.webkit.org/show_bug.cgi?id=154174

Reviewed by Tim Horton.

NSRangeIsRelativeTo -> WebRangeIsRelativeTo

WebView/WebFrame.mm:

(-[WebFrame _convertToDOMRange:]):
(-[WebFrame _convertToDOMRange:rangeIsRelativeTo:]):

WebView/WebFrameInternal.h:
WebView/WebHTMLView.mm:

(-[WebHTMLView insertText:]):

11:28 AM Changeset in webkit [196488] by BJ Burg

8 edits
9 adds in trunk/Source/WebKit2

Add a WebKit SPI for creating an automation session and advertise the active session via RemoteInspector
https://bugs.webkit.org/show_bug.cgi?id=153934

Reviewed by Dan Bernstein and Joseph Pecoraro.

An automation session is the main place where WebKit support for user agent automation is implemented.
A session encapsulates the state (default timeouts, page identifier mappings), objects (active automation
WebPages) and logic (how to open a window, run JS, send user input, etc.) used to implement automation
commands.

A process pool can only have one session at a time. The session is created by the WebKit client in
response to a request that comes through _WKAutomationDelegate. When a session is set on the process pool,
it is advertised to remote drivers and debuggers as a RemoteControllableTarget. A remote driver can use
the existing RemoteInspector API to connect to the session and send it automation commands.

The session has a delegate so that WebKit clients can perform actions that are outside the scope of WebKit,
such as creating new tabs, enumerating windows, or sending native user inputs.

This patch adds AutomationSession classes at the API and implementation level in WebKit2. The
implementation class contains RemoteInspector support, which cannot be used directly by WebKit clients.
AutomationSessionDelegate classes exist at both the API and implementation level to bridge between
Objective-C delegates and C++ clients. All code related to RemoteInspector and RemoteAutomationTarget
must be guarded by ENABLE(REMOTE_INSPECTOR).

Shared/API/APIObject.h: Add new API type 'AutomationSession'.
Shared/Cocoa/APIObject.mm:

(API::Object::newObject): Allocate in the wrapper.

UIProcess/API/APIAutomationSessionClient.h: Added.

(API::AutomationSessionClient::~AutomationSessionClient):
(API::AutomationSessionClient::didRequestNewWindow): Delegate window creation to the client.

UIProcess/API/Cocoa/WKProcessPool.mm:

(-[WKProcessPool _setAutomationSession:]): Keep at most one WebAutomationSession at a time.

UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
UIProcess/API/Cocoa/_WKAutomationSession.h: Added.
UIProcess/API/Cocoa/_WKAutomationSession.mm: Added.

(-[_WKAutomationSession init]): Construct the API object in the implementation wrapper.
(-[_WKAutomationSession dealloc]): Clear the client before calling the implementation destructor.

(-[_WKAutomationSession sessionIdentifier]):
(-[_WKAutomationSession setSessionIdentifier:]):
Store the session identifier string in the implementation.

(-[_WKAutomationSession delegate]):
(-[_WKAutomationSession setDelegate:]):
Create an Objective-C adapter for the delegate if not nil and set it as the implementation's client.

(-[_WKAutomationSession _apiObject]):

UIProcess/API/Cocoa/_WKAutomationSessionDelegate.h: Added.
UIProcess/API/Cocoa/_WKAutomationSessionInternal.h: Added.

(wrapper):

UIProcess/Cocoa/AutomationSessionClient.h: Added.

Set up the boilerplate for caching delegate method availability. It will include more methods later.

UIProcess/Cocoa/AutomationSessionClient.mm: Added. Forward requests to the SPI delegate.

(WebKit::AutomationSessionClient::AutomationSessionClient):
(WebKit::AutomationSessionClient::didRequestNewWindow): Delegate window creation to the client.

UIProcess/WebAutomationSession.cpp: Added.

(WebKit::WebAutomationSession::WebAutomationSession):
By default, a session should be available and not paired to any particular remote driver.

(WebKit::WebAutomationSession::~WebAutomationSession): Require callers to clear the client first.
(WebKit::WebAutomationSession::setClient):
(WebKit::WebAutomationSession::dispatchMessageFromRemote): Stub this out for now.

(WebKit::WebAutomationSession::connect):
(WebKit::WebAutomationSession::disconnect):
To prevent multiple connection attempts, mark the target as paired when a remote client has connected.

UIProcess/WebAutomationSession.h: Added.
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::setAutomationSession):
Store the session object and tell it to register itself. Unregistering happens automatically
in RemoteControllableTarget::~RemoteControllableTarget.

UIProcess/WebProcessPool.h:
WebKit2.xcodeproj/project.pbxproj: Add files and headers.

11:18 AM Changeset in webkit [196487] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.9/Source/WebKit

Merged r196462. rdar://problem/24622882

11:07 AM Changeset in webkit [196486] by bshafiei@apple.com

3 edits in tags/Safari-602.1.18.9/Source/WebCore

Merged r196023. rdar://problem/24411911

11:06 AM Changeset in webkit [196485] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.9/Source

Versioning.

11:02 AM Changeset in webkit [196484] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.9

New tag.

10:34 AM Changeset in webkit [196483] by akling@apple.com

9 edits in trunk/Source/WebCore

[Mac] BitmapImage::decodedDataIsPurgeable() is telling lies and causing massive memory usage.
<https://webkit.org/b/154172>

Reviewed by Antti Koivisto.

The underlying mechanism in CoreAnimation that made this work is no longer in place.

Instead of keeping purgeable frames and juggling volatility bits, we were simply caching
every single frame of large GIF animations, sometimes leading to monstrous memory usage.

Remove the code from WebCore since it's not doing at all what it means to.

Now iOS and Mac will behave the same again, and frame caching decisions will be
made by WebKit, based on total pixel byte size.

loader/cache/CachedImage.h:
loader/cache/CachedResource.h:

(WebCore::CachedResource::decodedDataIsPurgeable): Deleted.

loader/cache/MemoryCache.cpp:

(WebCore::MemoryCache::pruneLiveResourcesToSize): Deleted.

platform/graphics/BitmapImage.cpp:

(WebCore::BitmapImage::decodedDataIsPurgeable): Deleted.
(WebCore::BitmapImage::destroyDecodedDataIfNecessary): Deleted.

platform/graphics/BitmapImage.h:
platform/graphics/Image.h:

(WebCore::Image::decodedDataIsPurgeable): Deleted.

platform/graphics/cg/BitmapImageCG.cpp:

(WebCore::BitmapImage::decodedDataIsPurgeable): Deleted.

platform/graphics/cg/ImageSourceCG.cpp:

(WebCore::ImageSource::createFrameAtIndex): Deleted.

10:30 AM Changeset in webkit [196482] by beidson@apple.com

16 edits
1 add in trunk/Source/WebCore

Modern IDB: Ref cycle between IDBObjectStore and IDBIndex.
https://bugs.webkit.org/show_bug.cgi?id=154110

Reviewed by Darin Adler.

No new tests (Currently untestable).

The lifetime of IDBObjectStore and IDBIndex are closely intertwined, but we have to break the ref cycle.

This patch does a few semi-gnarly things:
1 - Makes both IDBIndex and IDBObjectStore have a custom marking function so they can add each other as

opaque roots.

2 - Adds a lock to protect IDBObjectStore's collection of referenced indexes to support #1, as GC marking

can happen on any thread.

3 - Makes IDBIndex not be traditionally RefCounted; Instead, IDBIndex::ref()/deref() simply ref()/deref()

the owning IDBObjectStore.

4 - ...Except when somebody deletes an IDBIndex from its IDBObjectStore. Once that happens, the object

store no longer has a reference back to the index, but the index still needs a reference back to the
object store. To support this, the IDBIndex becomes "traditionally RefCounted" while holding a ref to
its IDBObjectStore.

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:

Modules/indexeddb/IDBIndex.h:

(WebCore::IDBIndex::isModern):

Modules/indexeddb/IDBIndex.idl:

Modules/indexeddb/IDBObjectStore.h:

(WebCore::IDBObjectStore::isModern):

Modules/indexeddb/IDBObjectStore.idl:

Modules/indexeddb/client/IDBIndexImpl.cpp:

(WebCore::IDBClient::IDBIndex::objectStore):
(WebCore::IDBClient::IDBIndex::openCursor):
(WebCore::IDBClient::IDBIndex::doCount):
(WebCore::IDBClient::IDBIndex::openKeyCursor):
(WebCore::IDBClient::IDBIndex::doGet):
(WebCore::IDBClient::IDBIndex::doGetKey):
(WebCore::IDBClient::IDBIndex::markAsDeleted):
(WebCore::IDBClient::IDBIndex::ref):
(WebCore::IDBClient::IDBIndex::deref):
(WebCore::IDBClient::IDBIndex::create): Deleted.

Modules/indexeddb/client/IDBIndexImpl.h:

(WebCore::IDBClient::IDBIndex::modernObjectStore):

Modules/indexeddb/client/IDBObjectStoreImpl.cpp:

(WebCore::IDBClient::IDBObjectStore::createIndex):
(WebCore::IDBClient::IDBObjectStore::index):
(WebCore::IDBClient::IDBObjectStore::deleteIndex):
(WebCore::IDBClient::IDBObjectStore::visitReferencedIndexes):

Modules/indexeddb/client/IDBObjectStoreImpl.h:

Modules/indexeddb/client/IDBTransactionImpl.cpp:

(WebCore::IDBClient::IDBTransaction::createIndex):

Modules/indexeddb/client/IDBTransactionImpl.h:

Modules/indexeddb/legacy/LegacyIndex.cpp:

(WebCore::LegacyIndex::ref):
(WebCore::LegacyIndex::deref):

Modules/indexeddb/legacy/LegacyIndex.h:

bindings/js/JSIDBIndexCustom.cpp: Added.

(WebCore::JSIDBIndex::visitAdditionalChildren):

bindings/js/JSIDBObjectStoreCustom.cpp:

(WebCore::JSIDBObjectStore::visitAdditionalChildren):

9:33 AM Changeset in webkit [196481] by Csaba Osztrogonác

8 edits in trunk

[EFL][GTK] Fix ENABLE(SVG_OTF_CONVERTER) build
https://bugs.webkit.org/show_bug.cgi?id=154165

Reviewed by Alex Christensen.

Source/cmake/OptionsEfl.cmake:
Source/cmake/OptionsGTK.cmake:

Source/WebCore:

CMakeLists.txt:
css/CSSFontFaceSource.cpp:

(WebCore::CSSFontFaceSource::font):

svg/SVGToOTFFontConversion.cpp:
svg/SVGToOTFFontConversion.h:

9:24 AM Changeset in webkit [196480] by andersca@apple.com

3 edits in trunk/Source/WebKit2

Get rid of NetscapePluginModule::createPluginMIMETypesPreferences
https://bugs.webkit.org/show_bug.cgi?id=154173

Reviewed by Dan Bernstein.

Shared/Plugins/Netscape/NetscapePluginModule.h:
Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:

(WebKit::NetscapePluginModule::createPluginMIMETypesPreferences): Deleted.

9:23 AM Changeset in webkit [196479] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196466

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

9:10 AM Changeset in webkit [196478] by andersca@apple.com

2 edits
6 deletes in trunk/Source/WebKit2

Remove legacy processes from WebKit2
https://bugs.webkit.org/show_bug.cgi?id=154119

Reviewed by Darin Adler.

Configurations/BaseLegacyProcess.xcconfig: Removed.
DatabaseProcess/EntryPoint/mac/LegacyProcess/DatabaseProcessMain.mm: Removed.

(DatabaseProcessMain): Deleted.

DatabaseProcess/EntryPoint/mac/LegacyProcess/Info.plist: Removed.
NetworkProcess/EntryPoint/mac/LegacyProcess/Info.plist: Removed.
NetworkProcess/EntryPoint/mac/LegacyProcess/NetworkProcessMain.mm: Removed.

(NetworkProcessMain): Deleted.

PluginProcess/EntryPoint/mac/LegacyProcess/Info.plist: Removed.
PluginProcess/EntryPoint/mac/LegacyProcess/PluginProcessMain.mm: Removed.

(WebKit::PluginProcessMainDelegate::PluginProcessMainDelegate): Deleted.
(PluginProcessMain): Deleted.

Shared/EntryPointUtilities/mac/LegacyProcess/ChildProcessEntryPoint.h: Removed.

(WebKit::ChildProcessMainDelegate::ChildProcessMainDelegate): Deleted.
(WebKit::ChildProcessMain): Deleted.

Shared/EntryPointUtilities/mac/LegacyProcess/ChildProcessEntryPoint.mm: Removed.

(WebKit::ChildProcessMainDelegate::~ChildProcessMainDelegate): Deleted.
(WebKit::ChildProcessMainDelegate::installSignalHandlers): Deleted.
(WebKit::ChildProcessMainDelegate::doPreInitializationWork): Deleted.
(WebKit::ChildProcessMainDelegate::getConnectionIdentifier): Deleted.
(WebKit::ChildProcessMainDelegate::getClientIdentifier): Deleted.
(WebKit::ChildProcessMainDelegate::getClientProcessName): Deleted.
(WebKit::ChildProcessMainDelegate::getExtraInitializationData): Deleted.
(WebKit::ChildProcessMainDelegate::startRunLoop): Deleted.
(WebKit::ChildProcessMainDelegate::doPostRunWork): Deleted.

Shared/EntryPointUtilities/mac/LegacyProcess/ChildProcessMain.mm: Removed.

(WebKit::closeUnusedFileDescriptors): Deleted.
(WebKit::BootstrapMain): Deleted.
(main): Deleted.

WebKit2.xcodeproj/project.pbxproj:
WebProcess/EntryPoint/mac/LegacyProcess/Info.plist: Removed.
WebProcess/EntryPoint/mac/LegacyProcess/WebContentProcessMain.mm: Removed.

(WebKit::WebContentProcessMainDelegate::WebContentProcessMainDelegate): Deleted.
(WebContentProcessMain): Deleted.

9:00 AM Changeset in webkit [196477] by bshafiei@apple.com

12 edits in branches/safari-601.1.46-branch

Merged r196401. rdar://problem/24611749

8:49 AM Changeset in webkit [196476] by Chris Dumez

22 edits in trunk/Source/WebCore

Unreviewed nit fixes after r196466.

Modules/speech/SpeechSynthesisUtterance.idl: Fix curly bracket placement.
bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader): Use wrappableObject instead of domObject.

bindings/scripts/test/*: Rebaseline.
dom/WebKitNamedFlow.idl: Drop unnecessary #if case.

8:40 AM Changeset in webkit [196475] by Carlos Garcia Campos

2 edits in trunk/Source/WebKit2

[GTK] HTTP auth dialog incorrectly rendered with Accelerated Compositing enabled
https://bugs.webkit.org/show_bug.cgi?id=154159

Reviewed by Michael Catanzaro.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewRenderAcceleratedCompositingResults):
(webkitWebViewBaseDraw):

8:37 AM Changeset in webkit [196474] by Carlos Garcia Campos

2 edits in trunk/Source/WebCore

[GTK] Properly handle classes inheriting from EventTarget
https://bugs.webkit.org/show_bug.cgi?id=154158

Reviewed by Michael Catanzaro.

Instead of removing its parent we now handle the case of classes
having EventTarget as parent to make them implement the interface
instead.

bindings/scripts/CodeGeneratorGObject.pm:

(ShouldBeExposedAsInterface): Whether the parent given class
should be exposed as an interface instead of a parent class.
(GetParentClassName): Return Object as parent for classes having
a parent that should be exposed as an interface.
(GetParentImplClassName): Ditto.
(GetBaseClass): Ditto.
(GetParentGObjType): Ditto.
(SkipFunction): Add FIXME comment.
(ImplementsInterface): Helper function to check if a class
implements the given interface.
(GenerateCFile): Check whether the class implements EventTarget to
generate the interface implementation.
(GenerateInterface): Do not remove the parent class when it's EventTarget.

7:49 AM Changeset in webkit [196473] by commit-queue@webkit.org

5 edits
2 deletes in trunk/Source/WebCore

Unreviewed, rolling out r196470.
https://bugs.webkit.org/show_bug.cgi?id=154167

Broke some tests (Requested by anttik on #webkit).

Reverted changeset:

"Factor class change style invalidation code into a class"
https://bugs.webkit.org/show_bug.cgi?id=154163
http://trac.webkit.org/changeset/196470

7:37 AM Changeset in webkit [196472] by matthew_hanson@apple.com

3 edits in branches/safari-601-branch/Source/WebInspectorUI

Merge r196362. rdar://problem/24611811

7:37 AM Changeset in webkit [196471] by matthew_hanson@apple.com

12 edits in branches/safari-601-branch

Merge r196401. rdar://problem/24611749

7:05 AM Changeset in webkit [196470] by Antti Koivisto

5 edits
2 adds in trunk/Source/WebCore

Factor class change style invalidation code into a class
https://bugs.webkit.org/show_bug.cgi?id=154163

Reviewed by Andreas Kling.

Factor this piece of functionality out of Element and into ClassChangeInvalidation class.

CMakeLists.txt:
WebCore.vcxproj/WebCore.vcxproj:
WebCore.xcodeproj/project.pbxproj:
dom/Element.cpp:

style/ClassChangeInvalidation.cpp: Added.

(WebCore::Style::ClassChangeInvalidation::computeClassChange):
(WebCore::Style::ClassChangeInvalidation::invalidateStyle):

style/ClassChangeInvalidation.h: Added.

(WebCore::Style::ClassChangeInvalidation::needsInvalidation):
(WebCore::Style::ClassChangeInvalidation::ClassChangeInvalidation):
(WebCore::Style::ClassChangeInvalidation::~ClassChangeInvalidation):

5:52 AM Changeset in webkit [196469] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

GCC buildfix in Source/WebCore/svg/SVGToOTFFontConversion.cpp
https://bugs.webkit.org/show_bug.cgi?id=154162

Reviewed by Andreas Kling.

svg/SVGToOTFFontConversion.cpp:

(WebCore::SVGToOTFFontConverter::finishAppendingKERNSubtable):

4:39 AM Changeset in webkit [196468] by akling@apple.com

2 edits in trunk/Source/WebCore

Don't invalidate the FontCache on memory pressure.
<https://webkit.org/b/154161>

Reviewed by Antti Koivisto.

Invalidating the FontCache does more harm than good:

Anything that's still in the cache at this point is also referenced outside the cache, thus will not actually get deleted.

Future deduplication will fail, leading to more objects.

The global FontCache generation gets bumped, causing future style recalcs to be less efficient and breaking style sharing.

All FontSelector invalidation callbacks will fire, potentially causing forced full-document style recalcs.

In fact, the only win from invalidating the FontCache comes from some
minor shrinkage in the containers that make up the cache itself.

platform/MemoryPressureHandler.cpp:

(WebCore::MemoryPressureHandler::releaseCriticalMemory): Deleted.

3:37 AM Changeset in webkit [196467] by clopez@igalia.com

2 edits in trunk/Source/WebKit2

[GTK] Allow applications to disable Accelerated Compositing mode.
https://bugs.webkit.org/show_bug.cgi?id=154147

Reviewed by Carlos Garcia Campos.

UIProcess/gtk/WebPreferencesGtk.cpp:

(WebKit::WebPreferences::platformInitializeStore): if the environment
variable WEBKIT_DISABLE_COMPOSITING_MODE is defined, then disable AC.

Feb 11, 2016:

11:28 PM Changeset in webkit [196466] by Chris Dumez

88 edits in trunk

[Web IDL] interfaces should inherit EventTarget instead of duplicating the EventTarget API
https://bugs.webkit.org/show_bug.cgi?id=154121
<rdar://problem/24613234>

Reviewed by Gavin Barraclough.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

web-platform-tests/dom/interfaces-expected.txt:
web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Interfaces should inherit EventTarget instead of duplicating the
EventTarget API in their IDL. Not only the duplication is ugly and
error-prone, but this also does not match the specifications and
have subtle web-exposed differences.

This patch takes care of all interfaces except for DOMWindow and
WorkerGlobalScope. Those will be updated in the follow-up patch
as they will require a little bit more work and testing.

We should also be able to get rid of the [EventTarget] WebKit IDL
attribute in a follow-up.

No new tests, already covered by existing tests.

Modules/battery/BatteryManager.idl:
Modules/encryptedmedia/MediaKeySession.idl:
Modules/indexeddb/IDBDatabase.h:
Modules/indexeddb/IDBDatabase.idl:
Modules/indexeddb/IDBRequest.h:
Modules/indexeddb/IDBRequest.idl:
Modules/indexeddb/IDBTransaction.h:
Modules/indexeddb/IDBTransaction.idl:
Modules/mediasession/MediaRemoteControls.idl:
Modules/mediasource/MediaSource.h:
Modules/mediasource/MediaSource.idl:
Modules/mediasource/SourceBuffer.h:
Modules/mediasource/SourceBuffer.idl:
Modules/mediasource/SourceBufferList.h:
Modules/mediasource/SourceBufferList.idl:
Modules/mediastream/MediaStream.h:
Modules/mediastream/MediaStream.idl:
Modules/mediastream/MediaStreamTrack.h:
Modules/mediastream/MediaStreamTrack.idl:
Modules/mediastream/RTCDTMFSender.h:
Modules/mediastream/RTCDTMFSender.idl:
Modules/mediastream/RTCDataChannel.h:
Modules/mediastream/RTCDataChannel.idl:
Modules/mediastream/RTCPeerConnection.h:
Modules/mediastream/RTCPeerConnection.idl:
Modules/notifications/Notification.idl:
Modules/speech/SpeechSynthesisUtterance.idl:
Modules/webaudio/AudioContext.idl:
Modules/webaudio/AudioNode.idl:
Modules/websockets/WebSocket.idl:
css/FontLoader.idl:
dom/EventTarget.h:
dom/MessagePort.idl:
dom/Node.h:
dom/Node.idl:
dom/WebKitNamedFlow.idl:
fileapi/FileReader.idl:
html/MediaController.idl:
html/track/AudioTrackList.idl:
html/track/TextTrack.idl:
html/track/TextTrackCue.idl:
html/track/TextTrackList.idl:
html/track/VideoTrackList.idl:
loader/appcache/DOMApplicationCache.h:
loader/appcache/DOMApplicationCache.idl:
page/EventSource.idl:
page/Performance.h:
page/Performance.idl:
workers/Worker.idl:
xml/XMLHttpRequest.h:
xml/XMLHttpRequest.idl:
xml/XMLHttpRequestUpload.idl:
Drop hardcoded EventTarget operations and inherit EventTarget instead.
Drop JSGenerateToNativeObject / JSGenerateToJSObject IDL extended attributes for interfaces inheriting the EventTarget interface as the bindings generator now does this automatically for us.
On native side, have EventTarget subclass ScriptWrappable instead of each of its subclasses doing so. The issue was that EventTargetOwner::finalize() was calling uncacheWrapper() with an EventTarget*, which would not clear inlined cached wrapped (see clearInlineCachedWrapper()) because EventTarget did not subclass ScriptWrappable. However, cacheWrapper() is called is a specific subtype pointer (e.g. Node*) and we would decide to create an inline cached wrapper because Node subclassed ScriptWrappable (as well as EventTarget).

WebCore.xcodeproj/project.pbxproj:

Export JSEventTarget.h as private header to fix the build.

bindings/js/JSDOMBinding.h:

(WebCore::wrapperKey):
(WebCore::getCachedWrapper):
(WebCore::cacheWrapper):
(WebCore::uncacheWrapper):
Use new wrapperKey() function that is generated for each bindings
class that also has wrapperOwner(). This is used instead of the
C cast to void* in order to cast to the base wrapped type to fix
issues with multiple inheritance. The issue was that cacheWrapper()
was getting called with a DOM object subtype pointer (e.g.
AudioContext*) but uncacheWrapper() was getting called with a base
wrapped type pointer (e.g. EventTarget*). Most of our DOM classes
use multiple inheritance and thus the pointer values (used as keys
in the weak map) may differ.

bindings/js/JSTrackCustom.cpp:

(WebCore::toJS):
Call CREATE_DOM_WRAPPER() with an actual wrapped type (e.g. AudioTrack)
instead of TrackBase type. TrackBase does not have corresponding
generated bindings and therefore does not have a wrapperKey()
function.

bindings/scripts/CodeGeneratorJS.pm:

(ShouldGenerateToWrapped):
(ShouldGenerateToJSDeclaration):
(GenerateHeader):

Generate a wrapperKey() utility function along-side wrapperOwner() to help cast to the base wrapped type.
Generate toWrapped() / toJS() utility functions for interfaces that inherit EventTarget as those are required by our implementation and this avoids having to explicitly have them in the IDL.

bindings/scripts/test/*:

Rebaseline bindings tests.

LayoutTests:

Rebaseline a couple of layout tests now that interfaces inherit EventTarget
instead of duplicating the EventTarget API in their IDL.

fast/dom/Window/window-properties-performance-expected.txt:
fast/dom/prototype-chain-expected.txt:

9:21 PM Changeset in webkit [196465] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

Land the change that was supposed to be the part of r196463.

public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage.prototype._didFetchTestGroups): Select the latest test group by default.

9:17 PM Changeset in webkit [196464] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: SourceCodeTextEditor close() generates removeEventListener warnings
https://bugs.webkit.org/show_bug.cgi?id=154150

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-11
Reviewed by Timothy Hatcher.

UserInterface/Views/SourceCodeTextEditor.js:

(WebInspector.SourceCodeTextEditor.prototype.close):
Remove the event listeners in the cases that we would have added them.
If we have SourceMap information we should remove the key listener,
and if we don't we should remove the SourceMapAdded listener.

9:14 PM Changeset in webkit [196463] by rniwa@webkit.org

7 edits in trunk/Websites/perf.webkit.org

Refine v3 UI's analysis task page
https://bugs.webkit.org/show_bug.cgi?id=154152

Reviewed by Chris Dumez.

This patch makes the following refinements to the analysis task page:

Always show the relative different of in-progress A/B testing.
Make the annotations (colored bars) in the chart open other analysis tasks.
Order the A/B testing groups in the reverse chronological order.
Select the time range corresponding to the current test group.

public/v3/components/analysis-results-viewer.js:

(AnalysisResultsViewer.cssTemplate): Fixed the bug that pending and running testing groups are no longer
colored after r196440. Use a slightly more opaque color for currently running groups compared to pending ones.

public/v3/components/chart-pane-base.js:

(ChartPaneBase.prototype.setMainSelection): Added.
(ChartPaneBase.prototype._openAnalysisTask): Moved the code from ChartPane._openAnalysisTask so that it can be
reused in both AnalysisTaskChartPane and ChartPane (in charts page).
(ChartPaneBase.prototype.router): Added. Overridden by each subclass.

public/v3/components/test-group-results-table.js:

(TestGroupResultsTable.prototype.buildRowGroups): Always show the summary (relative difference of A to B) as
long as there are some results in each set.

public/v3/models/test-group.js:

(TestGroup.prototype.compareTestResults): Always set .label and .fullLabel with the relative change as long as
there are some values. Keep using "pending" and "running" in .status since that would determine the color of
stacking blocks representing those A/B testing groups.

public/v3/pages/analysis-task-page.js:

(AnalysisTaskChartPane):
(AnalysisTaskChartPane.prototype.setPage): Added.
(AnalysisTaskChartPane.prototype.router): Added.
(AnalysisTaskPage):
(AnalysisTaskPage.prototype.render): Show the list of A/B testing groups in the reverse chronological order.
Also set the main chart's selection to the time range of the current test group.

public/v3/pages/chart-pane.js:

(ChartPane.prototype.router): Added.
(ChartPane.prototype._openAnalysisTask): Moved to ChartPaneBase.prototype._openAnalysisTask.

7:24 PM Changeset in webkit [196462] by achristensen@apple.com

2 edits in trunk/Source/WebKit

Fix internal Windows build.
rdar://problem/24622882

WebKit.vcxproj/WebKit.proj:

Don't define DEBUG_SUFFIX in release builds.

5:30 PM Changeset in webkit [196461] by Ryan Haddad

11 edits
2 deletes in trunk/Source/WebKit2

Unreviewed, rolling out r196453.
https://bugs.webkit.org/show_bug.cgi?id=154142

This change broke internal iOS builds (Requested by ryanhaddad
on #webkit).

Reverted changeset:

"Move Download authentication code to AuthenticationManager"
https://bugs.webkit.org/show_bug.cgi?id=154132
http://trac.webkit.org/changeset/196453

Patch by Commit Queue <commit-queue@webkit.org> on 2016-02-11

5:05 PM Changeset in webkit [196460] by Brent Fulgham

3 edits in trunk/Source/WebCore

Optimize texture-complete checks
https://bugs.webkit.org/show_bug.cgi?id=98308

Reviewed by Dean Jackson.

No new tests: No change in behavior.

html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::initializeNewContext): Initially consider all
textures as suspect.
(WebCore::WebGLRenderingContextBase::extensions): New helper function.
(WebCore::WebGLRenderingContextBase::reshape): Mark textures as invalid when appropriate.
(WebCore::WebGLRenderingContextBase::bindTexture): Identify invalid textures and mark
them for later fix-up. Likewise, remove 'known good' textures from the fix-up pass.
(WebCore::WebGLRenderingContextBase::deleteTexture): Remove instances of the deleted texture
from our set of invalid textures.
(WebCore::WebGLRenderingContextBase::checkTextureCompleteness): Only iterate through
the 'bad' textures, rather than checking every single texture.

html/canvas/WebGLRenderingContextBase.h:

5:05 PM Changeset in webkit [196459] by rniwa@webkit.org

2 edits
1 add in trunk/Websites/perf.webkit.org

Add a script to process backlogs created while perf dashboard was in the maintenance mode
https://bugs.webkit.org/show_bug.cgi?id=154140

Reviewed by Chris Dumez.

Added a script to process the backlog JSONs created while the perf dashboard was put in the maintenance mode.
It re-submits each JSON file to the perf dashboard using the same server config file used by syncing scripts.

public/include/report-processor.php:

(TestRunsGenerator::test_value_list_to_values_by_iterations): Fixed a bug in the error message code. It was
referencing an undeclared variable.

tools/process-maintenance-backlog.py: Added.

4:59 PM Changeset in webkit [196458] by mark.lam@apple.com

3 edits in trunk/Source/WTF

Need WTFCrash workaround for shipping SafariForWebKitDevelopment binaries.
https://bugs.webkit.org/show_bug.cgi?id=154125

Reviewed by Joseph Pecoraro.

Presently shipping SafariForWebKitDevelopment binaries still expect to link to a
WTFCrash function. We need to provide this function as a workaround until we can
update SafariForWebKitDevelopment to use the new inlined version.

We do this by doing:

Make WTFCrashImpl() the sole function for implementing a crash. The CRASH() macro is now defined to be WTFCrashImpl() instead of WTFCrash().
Renamed the legacy WTFCrash() to WTFCrashImpl() for debug or non-Darwin builds. For (non-debug && OS(DARWIN)) builds, WTFCrashImpl() will be an inlined function with an asm statement that issues a breakpoint trap.
Implement WTFCrash() as a function that calls CRASH(). This satisfies the need of shipping SafariForWebKitDevelopment binaries.
Change WTFCrashWithSecurityImplication() to call CRASH(). This ensures that we have a consistent implementation of how we crash.
Changed WTFLogAlwaysAndCrash() to call CRASH() instead of WTFCrash(). This is just to have consistency in that all code in the WebKit project now crashes by calling CRASH(), not WTFCrash().

wtf/Assertions.cpp:
wtf/Assertions.h:

4:40 PM Changeset in webkit [196457] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Use the system PluginProcess.app for generating plug-in MIME type preferences
https://bugs.webkit.org/show_bug.cgi?id=154139

Reviewed by Dan Bernstein.

UIProcess/Plugins/mac/PluginProcessProxyMac.mm:

(WebKit::PluginProcessProxy::createPropertyListFile):

4:31 PM Changeset in webkit [196456] by Beth Dakin

10 edits in trunk/Source

EditingRangeIsRelativeTo::Document and NSRangeIsRelativeTo::Document should
be called EditableRoot instead
https://bugs.webkit.org/show_bug.cgi?id=154138

Reviewed by Alexey Proskuryakov.

EditableRoot is much more accurate than Document.
Source/WebKit/mac:

WebView/WebFrame.mm:

(-[WebFrame _convertToDOMRange:]):
(-[WebFrame _convertToDOMRange:rangeIsRelativeTo:]):

WebView/WebFrameInternal.h:
WebView/WebHTMLView.mm:

(-[WebHTMLView insertText:]):

Source/WebKit2:

Shared/EditingRange.h:
UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::insertText):
(WebKit::WebViewImpl::selectedRangeWithCompletionHandler):

UIProcess/WebPageProxy.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::rangeFromEditingRange):

WebProcess/WebPage/WebPage.h:

4:17 PM Changeset in webkit [196455] by achristensen@apple.com

2 edits in trunk/Source/WebCore

Assert that IDBTransaction::transitionedToFinishing transitions to finishing.
https://bugs.webkit.org/show_bug.cgi?id=154061

Modules/indexeddb/client/IDBTransactionImpl.cpp:

(WebCore::IDBClient::IDBTransaction::transitionedToFinishing):
Added assertion that we are transitioning to a finished or finishing state, based on Darin's feedback.

4:02 PM Changeset in webkit [196454] by BJ Burg

5 edits in trunk/Source/JavaScriptCore

Web Inspector: RemoteInspector's listings should include whether an AutomationTarget is paired
https://bugs.webkit.org/show_bug.cgi?id=154077
<rdar://problem/24589133>

Reviewed by Joseph Pecoraro.

Instead of not generating a listing for the target when it is occupied,
generate the listing with a 'paired' flag. The old flag was redundant
because a _WKAutomationDelegate will not create a session if it doesn't
support automation or it already has an active session.

inspector/remote/RemoteAutomationTarget.cpp:

(Inspector::RemoteAutomationTarget::setIsPaired):
(Inspector::RemoteAutomationTarget::setAutomationAllowed): Deleted.

inspector/remote/RemoteAutomationTarget.h:

Return false for remoteControlAllowed() if the target is already paired.
This function is used by RemoteInspector to deny incoming connections.

inspector/remote/RemoteInspector.mm:

(Inspector::RemoteInspector::listingForAutomationTarget):

inspector/remote/RemoteInspectorConstants.h:

4:02 PM Changeset in webkit [196453] by achristensen@apple.com

11 edits
4 adds in trunk/Source/WebKit2

Move Download authentication code to AuthenticationManager
https://bugs.webkit.org/show_bug.cgi?id=154132

Reviewed by Sam Weinig.

NetworkProcess/Downloads/Download.h:
NetworkProcess/Downloads/ios/DownloadIOS.mm:

NetworkProcess/Downloads/mac/DownloadMac.mm:

NetworkProcess/Downloads/soup/DownloadSoup.cpp:

PlatformEfl.cmake:
PlatformGTK.cmake:
PlatformMac.cmake:
Shared/Authentication/AuthenticationManager.cpp:

Shared/Authentication/AuthenticationManager.h:

(WebKit::AuthenticationManager::outstandingAuthenticationChallengeCount):

Shared/Authentication/cocoa: Added.
Shared/Authentication/cocoa/AuthenticationManagerCocoa.mm: Added.

Shared/Authentication/soup: Added.
Shared/Authentication/soup/AuthenticationManagerSoup.cpp: Added.

WebKit2.xcodeproj/project.pbxproj:

3:39 PM Changeset in webkit [196452] by Beth Dakin

18 edits in trunk/Source

Soft spaces are often tracked in the wrong spot
https://bugs.webkit.org/show_bug.cgi?id=154127
-and corresponding-
rdar://problem/24493140

Reviewed by Sam Weinig.

Soft spaces are in the wrong space now for two reasons. First of all, the
NSRange we get from the accepted candidate is relative to the paragraph
start, so without this patch, soft spaces are only ever right for the first
paragraph. Secondly, if focus changes for any reason other than text
insertion, soft spaces are also wrong because they need to be re-set.

Source/WebKit/mac:

New version of _convertToDOMRange takes a NSRangeIsRelativeTo so that it can
handle ranges relative to both the document and the paragraph.

WebView/WebFrame.mm:

(-[WebFrame _convertToDOMRange:rangeIsRelativeTo:]):
(-[WebFrame _convertNSRangeToDOMRange:]):

New enum NSRangeIsRelativeTo.

WebView/WebFrameInternal.h:

Re-set the softSpaceRange on selection changes so long as the WebCore::Editor
is not currently handling an accepted candidate.

WebView/WebHTMLView.mm:

(-[WebHTMLView _selectionChanged]):

If needToRemoveSoftSpace is true, then the replacementRange is
relative to the paragraph.
(-[WebHTMLView insertText:]):

Source/WebKit2:

New enum can be used to indicate what an EditingRange is relative to.

Shared/EditingRange.h:

(WebKit::EditingRange::EditingRange):

didHandleAcceptedCandidate is a new message that gets sent from the
WebProcess. This lets us track a bool m_isHandlingAcceptedCandidate.

UIProcess/Cocoa/WebViewImpl.h:

(WebKit::WebViewImpl::didHandleAcceptedCandidate):

Re-set the m_softSpaceRange on selection changes so long as
m_isHandlingAcceptedCandidate is false.

UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::selectionDidChange):

Set m_isHandlingAcceptedCandidate to true.
(WebKit::WebViewImpl::handleAcceptedCandidate):

Set m_isHandlingAcceptedCandidate to false.
(WebKit::WebViewImpl::didHandleAcceptedCandidate):

insertTextAsync takes a new parameter indicating what the replacementRange is
relative to. If needToRemoveSoftSpace is true, then the replacementRange is
relative to the paragraph.
(WebKit::WebViewImpl::insertText):

Pipe didHandleAcceptedCandidate through to WebViewImpl.

UIProcess/PageClient.h:

insertTextAsync takes an EditingRangeIsRelativeTo.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::insertTextAsync):

Pipe didHandleAcceptedCandidate through to WebViewImpl.
(WebKit::WebPageProxy::didHandleAcceptedCandidate):

UIProcess/WebPageProxy.h:

New message lets the WebProcess tell the UIProcess when the candidate has
been accepted.

UIProcess/WebPageProxy.messages.in:

Pipe didHandleAcceptedCandidate through to WebViewImpl.

UIProcess/mac/PageClientImpl.h:
UIProcess/mac/PageClientImpl.mm:

(WebKit::PageClientImpl::didHandleAcceptedCandidate):

insertTextAsync takes an EditingRangeIsRelativeTo. Pass that through to
rangeFromEditingRange to get the correct range.

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::insertTextAsync):

Use the EditingRangeIsRelativeTo to find the right WebCore::Range.
(WebKit::WebPage::rangeFromEditingRange):

Take EditingRangeIsRelativeTo in a few places.

WebProcess/WebPage/WebPage.h:

InsertTextAsync takes a EditingRangeIsRelativeTo.

WebProcess/WebPage/WebPage.messages.in:

Send didHandleAccpetedCandidate to the UIProcess

WebProcess/WebPage/mac/WebPageMac.mm:

(WebKit::WebPage::handleAcceptedCandidate):

3:17 PM Changeset in webkit [196451] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.0.4/Source/WebCore

Merged r196445. rdar://problem/24511860

3:13 PM Changeset in webkit [196450] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.8/Source

Versioning.

3:12 PM Changeset in webkit [196449] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.0.4/Source

Versioning.

3:11 PM Changeset in webkit [196448] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.8

New tag.

3:07 PM Changeset in webkit [196447] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.0.4

New tag.

3:06 PM Changeset in webkit [196446] by fpizlo@apple.com

4 edits in trunk/Source/JavaScriptCore

DFG::ByteCodeParser needs to null check the result of presenceLike()
https://bugs.webkit.org/show_bug.cgi?id=154135
rdar://problem/24291586

Reviewed by Geoffrey Garen.

ByteCodeParser::presenceLike() could return a null object property condition if it detects a
contradiction. That could happen due to bogus profiling. It's totally OK - we just need to
bail from using a property condition when that happens.

bytecode/ObjectPropertyCondition.h:

(JSC::ObjectPropertyCondition::equivalence):
(JSC::ObjectPropertyCondition::operator bool):
(JSC::ObjectPropertyCondition::object):
(JSC::ObjectPropertyCondition::condition):
(JSC::ObjectPropertyCondition::operator!): Deleted.

bytecode/PropertyCondition.h:

(JSC::PropertyCondition::equivalence):
(JSC::PropertyCondition::operator bool):
(JSC::PropertyCondition::kind):
(JSC::PropertyCondition::uid):
(JSC::PropertyCondition::operator!): Deleted.

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::check):
(JSC::DFG::ByteCodeParser::load):

3:04 PM Changeset in webkit [196445] by enrica@apple.com

2 edits in trunk/Source/WebCore

WebContent process crashes when performing data detection on content with existing data detector links.
https://bugs.webkit.org/show_bug.cgi?id=154118
rdar://problem/24511860

Reviewed by Tim Horton.

The DOM mutation caused by removing the existing links, can shift the range endpoints.
We now save the range enpoints as positions so that we can recreate the ranges,
if a DOM mutation occurred.

editing/cocoa/DataDetection.mm:

(WebCore::removeResultLinksFromAnchor):
(WebCore::searchForLinkRemovingExistingDDLinks):
(WebCore::DataDetection::detectContentInRange):

3:01 PM Changeset in webkit [196444] by benjamin@webkit.org

2 edits in trunk/Source/JavaScriptCore

[JSC] SqrtFloat and CeilFloat also suffer from partial register stalls
https://bugs.webkit.org/show_bug.cgi?id=154131

Reviewed by Filip Pizlo.

Looks like I forgot to update this when adding Float support.
Credit to Filip for finding this issue.

b3/air/AirFixPartialRegisterStalls.cpp:

2:52 PM Changeset in webkit [196443] by rniwa@webkit.org

3 edits in trunk/Websites/perf.webkit.org

AnalysisResultsViewer never uses this._smallerIsBetter
https://bugs.webkit.org/show_bug.cgi?id=154134

Reviewed by Chris Dumez.

Removed the unused instance variable _smallerIsBetter from AnalysisResultsViewer and TestGroupStackingBlock.

public/v3/components/analysis-results-viewer.js:

(AnalysisResultsViewer): Removed the unused _smallerIsBetter.
(AnalysisResultsViewer.prototype.setSmallerIsBetter): Deleted.
(AnalysisResultsViewer.prototype.buildRowGroups):
(AnalysisResultsViewer.TestGroupStackingBlock): Removed the unused _smallerIsBetter.

public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage.prototype._didFetchTask):

2:34 PM Changeset in webkit [196442] by jer.noble@apple.com

9 edits in trunk/Source/WebCore

Make MediaResourceLoader behave more like a CachedResourceLoader.
https://bugs.webkit.org/show_bug.cgi?id=154117

Reviewed by Alex Christensen.

MediaResourceLoader currently can only handle a single request at a time. Split the class
into two, MediaResourceLoader and MediaResource, effectively wrapping CachedResourceLoader
and CachedRawResource respectively. With this devision, the same loader can be used to issue
multiple simultaneous resource requests.

This necessecitates splitting PlatformMediaResource into two classes as well. To simplify
the HTMLMediaElement, MediaPlayer, and MediaPlayerClient APIs, do not require a client
object when creating the loader; instead, the client is required to create the resource.
This also matches the CachedRawResource API.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::mediaPlayerCreateResourceLoader): Remove the client parameter.

html/HTMLMediaElement.h:
loader/MediaResourceLoader.cpp:

(WebCore::MediaResourceLoader::MediaResourceLoader):
(WebCore::MediaResourceLoader::~MediaResourceLoader):
(WebCore::MediaResourceLoader::requestResource): Renamed from start().
(WebCore::MediaResourceLoader::removeResource): Remove resource from live resource list.
(WebCore::MediaResource::create): Utility factory.
(WebCore::MediaResource::MediaResource):
(WebCore::MediaResource::~MediaResource):
(WebCore::MediaResource::stop): Moved from MediaResourceLoader.
(WebCore::MediaResource::setDefersLoading): Ditto.
(WebCore::MediaResource::responseReceived): Ditto.
(WebCore::MediaResource::redirectReceived): Ditto.
(WebCore::MediaResource::dataSent): Ditto.
(WebCore::MediaResource::dataReceived): Ditto.
(WebCore::MediaResource::notifyFinished): Ditto.
(WebCore::MediaResource::getOrCreateReadBuffer): Ditto.

loader/MediaResourceLoader.h:
platform/graphics/MediaPlayer.cpp:

(WebCore::MediaPlayer::createResourceLoader):

platform/graphics/MediaPlayer.h:

(WebCore::MediaPlayerClient::mediaPlayerCreateResourceLoader):

platform/graphics/PlatformMediaResourceLoader.h:

(WebCore::PlatformMediaResourceClient::~PlatformMediaResourceClient): Renamed from PlatformMediaResourceLoaderClient.
(WebCore::PlatformMediaResourceClient::responseReceived): Client methods now take a reference to the resource.
(WebCore::PlatformMediaResourceClient::redirectReceived): Ditto.
(WebCore::PlatformMediaResourceClient::dataSent): Ditto.
(WebCore::PlatformMediaResourceClient::dataReceived): Ditto.
(WebCore::PlatformMediaResourceClient::accessControlCheckFailed): Ditto.
(WebCore::PlatformMediaResourceClient::loadFailed): Ditto.
(WebCore::PlatformMediaResourceClient::loadFinished): Ditto.
(WebCore::PlatformMediaResourceClient::getOrCreateReadBuffer): Ditto.
(WebCore::PlatformMediaResourceLoader::PlatformMediaResourceLoader): Ditto.
(WebCore::PlatformMediaResource::PlatformMediaResource):
(WebCore::PlatformMediaResource::~PlatformMediaResource):
(WebCore::PlatformMediaResource::setClient):

platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

(webKitWebSrcStart):
(webKitWebSrcNeedData):
(webKitWebSrcEnoughData):
(CachedResourceStreamingClient::getOrCreateReadBuffer):
(CachedResourceStreamingClient::responseReceived):
(CachedResourceStreamingClient::dataReceived):
(CachedResourceStreamingClient::accessControlCheckFailed):
(CachedResourceStreamingClient::loadFailed):
(CachedResourceStreamingClient::loadFinished):

2:28 PM Changeset in webkit [196441] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

Build fix after r196440.

public/v3/models/test-group.js:

(TestGroup.prototype.addBuildRequest): Clear the map instead of setting the property to null.

2:17 PM Changeset in webkit [196440] by rniwa@webkit.org

9 edits in trunk/Websites/perf.webkit.org

Perf dashboard should have UI to retry A/B testing
https://bugs.webkit.org/show_bug.cgi?id=154090

Reviewed by Chris Dumez.

Added a button to re-try an existing A/B testing group with a custom repetition count. The same button functions
as a way of confirming the progression/regression when there have been no A/B testing scheduled in the task.

Also fixed the bug that A/B testing groups that have been waiting for other test groups will be shown as "running".

public/v3/components/results-table.js:

(ResultsTable.cssTemplate): Don't pad the list of extra repositories when it's empty.

public/v3/components/test-group-results-table.js:

(TestGroupResultsTable.prototype.buildRowGroups): Use TestGroup.labelForRootSet instead of manually
computing the letter for each configuration set.

public/v3/models/build-request.js:

(BuildRequest.prototype.hasStarted): Added.

public/v3/models/data-model.js:

(DataModelObject.ensureSingleton): Added.
(DataModelObject.cachedFetch): Added noCache option. This is used when re-fetching the test groups after
creating one.

public/v3/models/measurement-cluster.js:

(MeasurementCluster.prototype.startTime): Added.

public/v3/models/measurement-set.js:

(MeasurementSet.prototype.hasFetchedRange): Added. Returns true only if there are no "holes" (cluster
yet to be fetched) between the specified time range. This was added to fix a bug in AnalysisTaskPage's
_didFetchMeasurement.

public/v3/models/test-group.js:

(TestGroup): Added this._rootSetToLabel.
(TestGroup.prototype.addBuildRequest): Reset this._rootSetToLabel along with this._requestedRootSets.
(TestGroup.prototype.repetitionCount): Added. Returns the number of iterations executed per set. We assume that
every root set in the test group shares a single repetition count.
(TestGroup.prototype.requestedRootSets): Now populates this._rootSetToLabel for labelForRootSet.
(TestGroup.prototype.labelForRootSet): Added.
(TestGroup.prototype.hasStarted): Added.
(TestGroup.prototype.compareTestResults): Use 'running' and 'pending' to differentiate test groups that are waiting
for other groups to finish running from the ones that are actually running ('incomplete' before this patch).
(TestGroup.fetchByTask):
(TestGroup.createAndRefetchTestGroups): Added. Creates a new test group using the privileged-api/create-test-group
and fetches the list of test groups for the specified analysis task.
(TestGroup._createModelsFromFetchedTestGroups): Extracted from TestGroup.fetchByTask.

public/v3/pages/analysis-task-page.js:

(AnalysisTaskPage): Initialize _renderedCurrentTestGroup to undefined so that we'd always can differentiate
the initial call to AnalysisTaskPage.render and subsequent calls in which it's identical to _currentTestGroup.
(AnalysisTaskPage.prototype._didFetchMeasurement): Fixed a bug that we don't exit early even when some
clusters in between startPoint and endPoint are still being fetched via newly added hasFetchedRange.
(AnalysisTaskPage.prototype.render): Update the default repetition count based on the current test group.
Also update the label of the button to "Confirm the change" if there is no A/B testing in this task.
(AnalysisTaskPage.prototype._retryCurrentTestGroup): Added. Re-triggers an existing A/B testing group or creates
the A/B testing for the entire range of the analysis task.
(AnalysisTaskPage.prototype._hasDuplicateTestGroupName): Added.
(AnalysisTaskPage.prototype._createRetryNameForTestGroup): Added.
(AnalysisTaskPage.htmlTemplate): Added form controls to re-trigger A/B testing.
(AnalysisTaskPage.cssTemplate): Updated the style.

2:15 PM Changeset in webkit [196439] by Alan Bujtas

37 edits in trunk

Subpixel rendering: Make focusring painting subpixel aware.
https://bugs.webkit.org/show_bug.cgi?id=154111

Reviewed by David Hyatt.

Do not integral snap focusring rects while collecting them (use device pixel snapping instead
right before passing them to GraphicsContext::drawFocusRing).

Source/WebCore:

Unable to test.

platform/graphics/GraphicsContext.h:
platform/graphics/displaylists/DisplayListItems.h:

(WebCore::DisplayList::DrawFocusRingRects::create):
(WebCore::DisplayList::DrawFocusRingRects::rects):
(WebCore::DisplayList::DrawFocusRingRects::DrawFocusRingRects):

platform/graphics/displaylists/DisplayListRecorder.cpp:

(WebCore::DisplayList::Recorder::drawFocusRing):

platform/graphics/displaylists/DisplayListRecorder.h:
platform/graphics/mac/GraphicsContextMac.mm:

(WebCore::GraphicsContext::drawFocusRing):

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::addFocusRingRectsForInlineChildren):
(WebCore::RenderBlock::addFocusRingRects):

rendering/RenderBlock.h:
rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::addFocusRingRectsForInlineChildren):

rendering/RenderBlockFlow.h:
rendering/RenderBox.cpp:

(WebCore::RenderBox::addFocusRingRects):

rendering/RenderBox.h:
rendering/RenderElement.cpp:

(WebCore::RenderElement::paintFocusRing):
(WebCore::RenderElement::issueRepaintForOutlineAuto):

rendering/RenderInline.cpp:

(WebCore::RenderInline::absoluteRects):
(WebCore::RenderInline::addFocusRingRects):

rendering/RenderInline.h:
rendering/RenderListBox.cpp:

(WebCore::RenderListBox::addFocusRingRects):

rendering/RenderListBox.h:
rendering/RenderObject.cpp:

(WebCore::RenderObject::addPDFURLRect):
(WebCore::RenderObject::absoluteFocusRingQuads):

rendering/RenderObject.h:

(WebCore::RenderObject::addFocusRingRects):

rendering/RenderTextControl.cpp:

(WebCore::RenderTextControl::addFocusRingRects):

rendering/RenderTextControl.h:
rendering/svg/RenderSVGContainer.cpp:

(WebCore::RenderSVGContainer::addFocusRingRects):

rendering/svg/RenderSVGContainer.h:
rendering/svg/RenderSVGImage.cpp:

(WebCore::RenderSVGImage::addFocusRingRects):

rendering/svg/RenderSVGImage.h:
rendering/svg/RenderSVGShape.cpp:

(WebCore::RenderSVGShape::addFocusRingRects):

rendering/svg/RenderSVGShape.h:

LayoutTests:

platform/mac/accessibility/image-link-expected.txt:
platform/mac/accessibility/mac/aria-columnrowheaders-expected.txt: Copied from LayoutTests/platform/mac/accessibility/table-cells-expected.txt.
platform/mac/accessibility/mac/document-links-expected.txt: Added.
platform/mac/accessibility/table-attributes-expected.txt:
platform/mac/accessibility/table-cells-expected.txt:
platform/mac/accessibility/table-sections-expected.txt:
platform/mac/accessibility/table-with-rules-expected.txt:

2:12 PM Changeset in webkit [196438] by mmaxfield@apple.com

3 edits in trunk/Source/WebCore

Addressing post-review comments after r196393

Unreviewed.

css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::getFontFace):

css/CSSSegmentedFontFace.h:

2:09 PM Changeset in webkit [196437] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Cannot call initializeIndex() if we didn't create the array using tryCreateUninitialized()
https://bugs.webkit.org/show_bug.cgi?id=154126

Reviewed by Saam Barati.

runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncSplice):

1:45 PM Changeset in webkit [196436] by dburkart@apple.com

2 edits in trunk/Tools

Large logs can bring down the webkit master
https://bugs.webkit.org/show_bug.cgi?id=122112

Reviewed by Lucas Forschler.

Implement the suggested fix of throwing away stdout / stderr.

BuildSlaveSupport/build.webkit.org-config/master.cfg:

(RunWebKit1LeakTests):

1:43 PM Changeset in webkit [196435] by Antti Koivisto

2 edits in trunk/Source/WebKit/win

Try to fix windows build.

DOMCoreClasses.cpp:

(DOMElement::style):
(DOMElement::offsetLeft):

1:24 PM Changeset in webkit [196434] by Sukolsak Sakshuwong

11 edits in trunk

[INTL] Implement Intl.NumberFormat.prototype.resolvedOptions ()
https://bugs.webkit.org/show_bug.cgi?id=147602

Reviewed by Darin Adler.

Source/JavaScriptCore:

This patch implements Intl.NumberFormat.prototype.resolvedOptions() according
to the ECMAScript 2015 Internationalization API spec (ECMA-402 2nd edition.)

runtime/IntlDateTimeFormat.cpp:

(JSC::localeData):

runtime/IntlNumberFormat.cpp:

(JSC::localeData):
(JSC::computeCurrencySortKey):
(JSC::extractCurrencySortKey):
(JSC::computeCurrencyDigits):
(JSC::IntlNumberFormat::initializeNumberFormat):
(JSC::IntlNumberFormat::styleString):
(JSC::IntlNumberFormat::currencyDisplayString):
(JSC::IntlNumberFormat::resolvedOptions):
(JSC::IntlNumberFormat::setBoundFormat):

runtime/IntlNumberFormat.h:
runtime/IntlNumberFormatConstructor.cpp:

(JSC::constructIntlNumberFormat):
(JSC::callIntlNumberFormat):

runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatPrototypeFuncResolvedOptions):

runtime/IntlObject.cpp:

(JSC::intlNumberOption):
(JSC::numberingSystemsForLocale):
(JSC::getNumberingSystemsForLocale): Deleted.

runtime/IntlObject.h:

LayoutTests:

js/intl-numberformat-expected.txt:
js/script-tests/intl-numberformat.js:

(testNumberFormat):

1:22 PM Changeset in webkit [196433] by fpizlo@apple.com

4 edits in trunk/Source/JavaScriptCore

MacroAssemblerX86 should be happy with shift(cx, cx)
https://bugs.webkit.org/show_bug.cgi?id=154124

Reviewed by Saam Barati.

Prior to this change the assembler asserted that shift_amount and dest cannot be the same.
That's a good assertion for when shift_amount is not in cx. But if it's in cx already then
it's OK for them to be the same. Air will sometimes do shift(cx, cx) if you do "x << x" and
the coalescing got particularly clever.

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::lshift32):
(JSC::MacroAssemblerX86Common::rshift32):
(JSC::MacroAssemblerX86Common::urshift32):

assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::lshift64):
(JSC::MacroAssemblerX86_64::rshift64):
(JSC::MacroAssemblerX86_64::urshift64):

b3/testb3.cpp:

(JSC::B3::testLShiftSelf32):
(JSC::B3::testRShiftSelf32):
(JSC::B3::testURShiftSelf32):
(JSC::B3::testLShiftSelf64):
(JSC::B3::testRShiftSelf64):
(JSC::B3::testURShiftSelf64):
(JSC::B3::run):

1:04 PM Changeset in webkit [196432] by sbarati@apple.com

2 edits in trunk/Source/JavaScriptCore

The sampling profiler's stack walker methods should be marked with SUPPRESS_ASAN
https://bugs.webkit.org/show_bug.cgi?id=154123

Reviewed by Mark Lam.

The entire premise of the sampling profiler is to load from
another thread's memory. We should SUPPRESS_ASAN on the
methods that do this.

runtime/SamplingProfiler.cpp:

(JSC::FrameWalker::FrameWalker):
(JSC::FrameWalker::walk):
(JSC::FrameWalker::advanceToParentFrame):
(JSC::FrameWalker::isAtTop):
(JSC::FrameWalker::resetAtMachineFrame):

12:50 PM Changeset in webkit [196431] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196423

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

12:33 PM Changeset in webkit [196430] by Antti Koivisto

12 edits in trunk/Source/WebCore

Rename Element::style() to Element::cssomStyle()
https://bugs.webkit.org/show_bug.cgi?id=154107

Reviewed by Alex Christensen.

It implements the IDL "style" attribute that returns a CSSOM object.
Inside WebCore "style" generally refers to a RenderStyle.

dom/Element.cpp:

(WebCore::Element::hasAttributeNS):
(WebCore::Element::cssomStyle):
(WebCore::Element::focus):
(WebCore::Element::style): Deleted.

dom/Element.h:

(WebCore::Element::tagQName):

dom/Element.idl:
dom/StyledElement.cpp:

(WebCore::StyledElement::~StyledElement):
(WebCore::StyledElement::cssomStyle):
(WebCore::StyledElement::style): Deleted.

dom/StyledElement.h:

(WebCore::StyledElement::synchronizeStyleAttributeInternal):
(WebCore::StyledElement::collectStyleForPresentationAttribute):

editing/Editor.cpp:

(WebCore::Editor::applyEditingStyleToElement):

inspector/InspectorCSSAgent.cpp:

(WebCore::InspectorCSSAgent::getMatchedStylesForNode):
(WebCore::InspectorCSSAgent::getInlineStylesForNode):
(WebCore::InspectorCSSAgent::asInspectorStyleSheet):

inspector/InspectorStyleSheet.cpp:

(WebCore::InspectorStyleSheetForInlineStyle::didModifyElementAttribute):
(WebCore::InspectorStyleSheetForInlineStyle::inlineStyle):
(WebCore::InspectorStyleSheetForInlineStyle::elementStyleText):

svg/SVGElement.idl:

11:52 AM Changeset in webkit [196429] by commit-queue@webkit.org

8 edits
1 add in trunk

[cmake] Consolidate TextureMapper file and include dir lists.
https://bugs.webkit.org/show_bug.cgi?id=154106

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-11
Reviewed by Michael Catanzaro.

Source/cmake/OptionsEfl.cmake: Expose USE_TEXTURE_MAPPER_GL to

CMake code.

Source/cmake/OptionsWinCairo.cmake: Ditto.

Source/WebCore:

No new tests needed.

CMakeLists.txt: Moved texmap include dir and source list to

TextureMapper.cmake, removed non-existent include dir "filters/texmap".

PlatformEfl.cmake: Moved texmap and coordinatedgraphics include

dirs and source list to TextureMapper.cmake.

PlatformGTK.cmake: Ditto, also removed non-existent include dir

"texmap/threadedcompositor"

PlatformWinCairo.cmake: Moved texmap files to TextureMapper.cmake.
platform/TextureMapper.cmake: Added.

11:49 AM Changeset in webkit [196428] by achristensen@apple.com

6 edits in trunk/Source/WebKit2

Use BlobResourceHandle when loading blob urls, even when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154096

Reviewed by Brady Eidson.

This fixes at least http/tests/xmlhttprequest/blob-request-byte-range.html.

NetworkProcess/NetworkDataTask.h:

Renamed NetworkDataTaskClient::didReceiveResponse to didReceiveResponseNetworkSession
to avoid conflicting with ResourceHandleClient::didReceiveResponse.

NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad):
Make a BlobResourceHandle instead of a NetworkDataTask if we have a request for a blob url.
(WebKit::NetworkLoad::~NetworkLoad):
(WebKit::NetworkLoad::setDefersLoading):
(WebKit::NetworkLoad::cancel):
(WebKit::NetworkLoad::continueWillSendRequest):
(WebKit::NetworkLoad::continueDidReceiveResponse):
(WebKit::NetworkLoad::sharedDidReceiveResponse):
(WebKit::NetworkLoad::convertTaskToDownload):
(WebKit::NetworkLoad::setPendingDownloadID):
(WebKit::NetworkLoad::didReceiveChallenge):
(WebKit::NetworkLoad::didReceiveResponseNetworkSession):
(WebKit::NetworkLoad::cannotShowURL):
(WebKit::NetworkLoad::didReceiveResponseAsync):
(WebKit::NetworkLoad::willSendRequestAsync):
(WebKit::NetworkLoad::canAuthenticateAgainstProtectionSpaceAsync):
(WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace):
(WebKit::NetworkLoad::supportsDataArray):
(WebKit::NetworkLoad::didReceiveDataArray):
(WebKit::NetworkLoad::didSendData):
(WebKit::NetworkLoad::receivedCancellation):
(WebKit::NetworkLoad::didReceiveResponse): Deleted.
Compile ResourceHandleClient when using NetworkSession because it is used for blobs now.
Also, add null checks because we now have NetworkLoads where either m_task or m_handle is always null.

NetworkProcess/NetworkLoad.h:

(WebKit::NetworkLoad::pendingDownloadID):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):

NetworkProcess/mac/NetworkLoadMac.mm:

(WebKit::NetworkLoad::willCacheResponseAsync):

11:43 AM Changeset in webkit [196427] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.7/Source/WebKit/win

Merged r195828. rdar://problem/24611721

11:39 AM Changeset in webkit [196426] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.7/Source

Versioning.

11:36 AM Changeset in webkit [196425] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.7

New tag.

10:51 AM Changeset in webkit [196424] by msaboff@apple.com

2 edits in trunk/Source/bmalloc

Unreviewed build fix after r196421.

Removed BASSERTs that are firing to eliminate Debug build crashes. I'll debug locally and
enable or alter after the issue is understood.

bmalloc/LargeObject.h:

(bmalloc::LargeObject::merge): Removed BASSERTs that are firing.

10:23 AM Changeset in webkit [196423] by Chris Dumez

40 edits in trunk

Move 'length' property to the prototype
https://bugs.webkit.org/show_bug.cgi?id=154051
<rdar://problem/24577385>

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

web-platform-tests/dom/collections/HTMLCollection-supported-property-names-expected.txt:
web-platform-tests/dom/collections/namednodemap-supported-property-names-expected.txt:
web-platform-tests/dom/interfaces-expected.txt:
web-platform-tests/dom/nodes/Element-children-expected.txt:
web-platform-tests/dom/nodes/Element-getElementsByTagName-expected.txt:
web-platform-tests/dom/nodes/attributes-expected.txt:
web-platform-tests/html/dom/documents/dom-tree-accessors/document.forms-expected.txt:
web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Move 'length' property to the prototype, where it should be. We used to
keep it on the instance because our implementation of
getOwnPropertySlot() was wrong for interfaces with a named property
getter. However, our implementation of getOwnPropertySlot() is now
spec-compliant so this should be OK.

Moving 'length' to the prototype is also a little bit risky in terms of
performance, especially for HTMLCollection / NodeList. However, I did
not see an impact on realistic benchmarks like Speedometer and only saw
a small impact (< 5%) on micro-benchmarks. I propose we make our behavior
correct and monitor performance. If we see any benchmark we care about
regress then we should try and optimize while keeping the attribute on
the prototype.

No new tests, already covered by existing tests.

bindings/js/JSDOMBinding.h:

(WebCore::getStaticValueSlotEntryWithoutCaching):

bindings/js/JSHTMLDocumentCustom.cpp:

(WebCore::JSHTMLDocument::getOwnPropertySlot):
(WebCore::JSHTMLDocument::nameGetter): Deleted.

bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::putDelegate):

bindings/js/JSPluginElementFunctions.h:

(WebCore::pluginElementCustomGetOwnPropertySlot):

bindings/js/JSStorageCustom.cpp:

(WebCore::JSStorage::deleteProperty):
(WebCore::JSStorage::deletePropertyByIndex):
(WebCore::JSStorage::putDelegate):
Leverage the new hasStaticPropertyTable static property in the
generated bindings for performance.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
Generate a "hasStaticPropertyTable" static const boolean property
for each bindings class so we can check at build time if
ClassInfo::staticPropHashTable is null.

(AttributeShouldBeOnInstance):
Move "length" to the prototype.

bindings/scripts/test/JS/JSTestActiveDOMObject.h:
bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
bindings/scripts/test/JS/JSTestEventConstructor.h:
bindings/scripts/test/JS/JSTestEventTarget.h:
bindings/scripts/test/JS/JSTestException.h:
bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
bindings/scripts/test/JS/JSTestInterface.h:
bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
bindings/scripts/test/JS/JSTestNamedConstructor.h:
bindings/scripts/test/JS/JSTestNode.h:
bindings/scripts/test/JS/JSTestNondeterministic.h:
bindings/scripts/test/JS/JSTestObj.h:
bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
bindings/scripts/test/JS/JSTestTypedefs.h:
bindings/scripts/test/JS/JSattribute.h:
bindings/scripts/test/JS/JSreadonly.h:

Rebaseline bindings tests.

LayoutTests:

Rebaseline a couple of existing layout tests now that 'length' is
on the prototype.

fast/dom/htmlcollection-getownpropertynames-expected.txt:
storage/domstorage/localstorage/delete-defineproperty-removal-expected.txt:

10:19 AM Changeset in webkit [196422] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

Fix the !(ENABLE(SHADOW_DOM)

ENABLE(DETAILS_ELEMENT)) after r196281

https://bugs.webkit.org/show_bug.cgi?id=154035

Reviewed by Antti Koivisto.

Follow-up fix after r196365. Removed guards around slotNodeIndex.

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::Context::Context):

8:01 AM Changeset in webkit [196421] by msaboff@apple.com

4 edits in trunk/Source/bmalloc

bmalloc: large aligned allocations will put 1 or 2 free object on free list without merging with free neighbors
https://bugs.webkit.org/show_bug.cgi?id=154091

Reviewed by Geoffrey Garen.

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateLarge): Deleted private helper version and rolled it into the two the
two public versions of allocateLarge().

bmalloc/Heap.h:
bmalloc/LargeObject.h:

(bmalloc::LargeObject::prevIsAllocated): New helper.
(bmalloc::LargeObject::nextIsAllocated): New helper.
(bmalloc::LargeObject::merge): Check that the merge object has allocated neighbors.

6:30 AM Changeset in webkit [196420] by fred.wang@free.fr

3 edits in trunk/Source/WebKit2

Bug 154103 - [GTK] Build error after bug 154046
https://bugs.webkit.org/show_bug.cgi?id=154103

Reviewed by Carlos Garcia Campos.

UIProcess/API/gtk/WebKitUserContent.cpp:

(_WebKitUserStyleSheet::_WebKitUserStyleSheet):
(webkitUserStyleSheetGetUserStyleSheet):

UIProcess/API/gtk/WebKitUserContentPrivate.h:

3:52 AM Changeset in webkit [196419] by Csaba Osztrogonác

6 edits in trunk/Source/JavaScriptCore

Unreviewed typo fix after r190063.

dfg/DFGSpeculativeJIT.cpp: Removed property svn:executable.
dfg/DFGSpeculativeJIT.h: Removed property svn:executable.
jit/JIT.h: Removed property svn:executable.
jit/JITInlines.h: Removed property svn:executable.
jit/JITOpcodes.cpp: Removed property svn:executable.

3:49 AM Changeset in webkit [196418] by Csaba Osztrogonác

1 edit in trunk/Source/JavaScriptCore/ChangeLog

Unreviewed typo fix after r190063.

dfg/DFGSpeculativeJIT.cpp: Removed property svn:executable.
dfg/DFGSpeculativeJIT.h: Removed property svn:executable.
jit/JIT.h: Removed property svn:executable.
jit/JITInlines.h: Removed property svn:executable.
jit/JITOpcodes.cpp: Removed property svn:executable.

2:40 AM Changeset in webkit [196417] by fred.wang@free.fr

11 edits in trunk/LayoutTests

Use Testharness.js for the MathML script tests
https://bugs.webkit.org/show_bug.cgi?id=154065

Reviewed by Darin Adler.

mathml/opentype/large-operators-munderover-expected.txt:
mathml/opentype/large-operators-munderover.html:
mathml/presentation/inferred-mrow-baseline-expected.txt:
mathml/presentation/inferred-mrow-baseline.html:
mathml/presentation/inferred-mrow-stretchy-expected.txt:
mathml/presentation/inferred-mrow-stretchy.html:
mathml/presentation/stretchy-depth-height-expected.txt:
mathml/presentation/stretchy-depth-height-symmetric-expected.txt:
mathml/presentation/stretchy-depth-height-symmetric.html:
mathml/presentation/stretchy-depth-height.html:

12:11 AM Changeset in webkit [196416] by jonlee@apple.com

2 edits in trunk/PerformanceTests

Fix a missing refactoring.

Animometer/tests/master/resources/multiply.js:

(animate): Move to Utilities.lerp.
(_lerp): Deleted.

Feb 10, 2016:

11:42 PM Changeset in webkit [196415] by jonlee@apple.com

6 edits
6 adds in trunk/PerformanceTests

Add new benchmark tests.
https://bugs.webkit.org/show_bug.cgi?id=154063

Provisionally reviewed by Said Abou-Hallawa.

Add tests for get/put image data, filters, opacity, and css transforms.

Animometer/resources/runner/benchmark-runner.js:

(_runBenchmarkAndRecordResults): Update the body background color to match that of
the stage.
(this._runNextIteration): Clear the background color style for the results page.

Animometer/resources/runner/tests.js:
Animometer/tests/master/focus.html: Added.
Animometer/tests/master/image-data.html: Added.
Animometer/tests/master/multiply.html: Added.
Animometer/tests/master/resources/focus.js: Added.
Animometer/tests/master/resources/image-data.js: Added.
Animometer/tests/master/resources/multiply.js: Added.
Animometer/tests/master/resources/stage.css: Move common styles out.
Animometer/tests/resources/main.js: Update Stage.randomBool to use Math.random.

Add Stage.randomSign for randomly setting a direction. Add the notion of the
current timestamp of the test to Benchmark, since some animations cycle through
colors and rely on an incremental counter like the time.

8:06 PM Changeset in webkit [196414] by keith_miller@apple.com

11 edits
1 add in trunk/Source/JavaScriptCore

Symbol.species accessors on builtin constructors should be configurable
https://bugs.webkit.org/show_bug.cgi?id=154097

Reviewed by Benjamin Poulain.

We did not have the Symbol.species accessors on our builtin constructors
marked as configurable. This does not accurately follow the ES6 spec as
the ES6 spec states that all default accessors on builtins should be
configurable. This means that we need an additional watchpoint on
ArrayConstructor to make sure that no users re-configures Symbol.species.

runtime/ArrayConstructor.cpp:

(JSC::ArrayConstructor::finishCreation):

runtime/ArrayPrototype.cpp:

(JSC::speciesConstructArray):
(JSC::ArrayPrototype::setConstructor):
(JSC::ArrayPrototypeAdaptiveInferredPropertyWatchpoint::handleFire):

runtime/ArrayPrototype.h:

(JSC::ArrayPrototype::didChangeConstructorOrSpeciesProperties):
(JSC::ArrayPrototype::didChangeConstructorProperty): Deleted.

runtime/JSArrayBufferConstructor.cpp:

(JSC::JSArrayBufferConstructor::finishCreation):

runtime/JSPromiseConstructor.cpp:

(JSC::JSPromiseConstructor::finishCreation):

runtime/JSTypedArrayViewConstructor.cpp:

(JSC::JSTypedArrayViewConstructor::finishCreation):

runtime/MapConstructor.cpp:

(JSC::MapConstructor::finishCreation):

runtime/RegExpConstructor.cpp:

(JSC::RegExpConstructor::finishCreation):

runtime/SetConstructor.cpp:

(JSC::SetConstructor::finishCreation):

tests/stress/array-species-config-array-constructor.js: Added.

(A):

tests/stress/symbol-species.js:

(testSymbolSpeciesOnConstructor):

7:20 PM Changeset in webkit [196413] by bshafiei@apple.com

5 edits in branches/safari-601.1.46-branch/Source

Versioning.

7:20 PM Changeset in webkit [196412] by bshafiei@apple.com

5 edits in branches/safari-601-branch/Source

Versioning.

6:21 PM Changeset in webkit [196411] by bshafiei@apple.com

1 copy in tags/Safari-601.1.46.98

New tag.

6:21 PM Changeset in webkit [196410] by bshafiei@apple.com

1 copy in tags/Safari-601.5.16

New tag.

5:35 PM Changeset in webkit [196409] by benjamin@webkit.org

2 edits in trunk/Source/JavaScriptCore

[JSC] The destination of Sqrt should be Def, not UseDef
https://bugs.webkit.org/show_bug.cgi?id=154086

Reviewed by Geoffrey Garen.

An unfortunate copy-paste: the destination of SqrtDouble and SqrtFloat
was defined as UseDef. As a result, the argument would be interfering
with everything defined prior.

b3/air/AirOpcode.opcodes:

5:18 PM Changeset in webkit [196408] by Ryan Haddad

2 edits in trunk/LayoutTests

Removing deleted tests from ios-simulator TestExpectations

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

5:00 PM Changeset in webkit [196407] by Ryan Haddad

2 edits in trunk/Source/WebCore

Updating bindings test reference file for JSTestEventConstructor.cpp after r196400

Unreviewed test gardening.

No new tests needed.

bindings/scripts/test/JS/JSTestEventConstructor.cpp:

(WebCore::JSTestEventConstructorConstructor::construct):

4:52 PM Changeset in webkit [196406] by timothy@apple.com

2 edits
1 add
2 deletes in trunk/Source/WebInspectorUI

Web Inspector: Add new icon for the Timeline Recording navigation bar item
https://bugs.webkit.org/show_bug.cgi?id=154089
rdar://problem/24595652

Reviewed by Brian Burg.

UserInterface/Images/Stopwatch.png: Removed.
UserInterface/Images/Stopwatch@2x.png: Removed.
UserInterface/Images/Stopwatch.svg: Added.
UserInterface/Views/TimelineIcons.css:

(.stopwatch-icon .icon): Use Stopwatch.svg.
(body:not(.mac-platform, .windows-platform) .stopwatch-icon .icon): Added for GTK+.

4:44 PM Changeset in webkit [196405] by Ryan Haddad

1 edit
1 add in trunk/LayoutTests

Adding an ios-simulator expectation for fast/dom/event-handler-attributes.html
https://bugs.webkit.org/show_bug.cgi?id=153763

Unreviewed test gardening.

platform/ios-simulator/fast/dom/event-handler-attributes-expected.txt: Added.

4:32 PM Changeset in webkit [196404] by Matt Baker

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Switching actions in Edit Breakpoint popover causes a jerk
https://bugs.webkit.org/show_bug.cgi?id=154093
<rdar://problem/24597869>

Reviewed by Timothy Hatcher.

Adjusted CodeMirror eval editor styles to match vanilla input field.

UserInterface/Views/BreakpointActionView.css:

(.breakpoint-action-eval-editor):

4:29 PM Changeset in webkit [196403] by jmarcell@apple.com

6 edits in trunk/Tools

Remove calls to parseInt in order to work with non-integer revisions
https://bugs.webkit.org/show_bug.cgi?id=153820

Reviewed by Daniel Bates.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotIteration.js:

(BuildbotIteration.prototype.sourceStampChanges): Remove calls to parseInt in order to work with non-integer
revisions.
(BuildbotIteration.prototype._parseData): Ditto.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotQueue.js:

(BuildbotQueue.prototype.update): Ditto.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/MockBuildbotQueueView.js:

(MockBuildbotQueueView.prototype._latestProductiveIteration): Change integers to strings in test code.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/MockTrac.js:

(MockTrac.prototype.get oldestRecordedRevisionNumber): Ditto.
(MockTrac.prototype.get latestRecordedRevisionNumber): Ditto.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/tests.js: Ditto.

4:29 PM Changeset in webkit [196402] by jmarcell@apple.com

5 edits in trunk/Tools

Teach dashboard code to compare non-integer revisions
https://bugs.webkit.org/show_bug.cgi?id=152345

Reviewed by Daniel Bates.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotQueue.js:

(BuildbotQueue.prototype.compareIterationsByRevisions): Compare non-integer revisions.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotQueueView.js:

(BuildbotQueueView.prototype._appendPendingRevisionCount): Use Trac.indexOfRevision in order to compare non-integer
revisions. Also uses new Trac.commitsOnBranchLaterThanRevision method.
(BuildbotQueueView.prototype._popoverLinesForCommitRange): Ditto.
(BuildbotQueueView.prototype._presentPopoverForPendingCommits): Use Trac.indexOfRevision in order to compare non-integer
revisions. Also uses new Trac.nextRevision method to calculate a revision range.
(BuildbotQueueView.prototype._revisionContentWithPopoverForIteration): Ditto.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/Trac.js:

(Trac.prototype._commitsOnBranch): Renamed this to indicate that it should be a private method used by the latter two new
methods.
(Trac.prototype.commitsOnBranchLaterThanRevision): Finds revisions on a branch later than the specified revision.
(Trac.prototype.commitsOnBranchInRevisionRange): Finds revisions on a branch within a specified range.
(Trac.prototype.nextRevision): Finds the next revision after a given revision on a specific branch.
(Trac.prototype.indexOfRevision): Finds the index of a given revision within the recordedCommits array.
(Trac.prototype.commitsOnBranch): Deleted. Renamed to _commitsOnBranch.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/tests.js: Added unit tests.

4:10 PM Changeset in webkit [196401] by eric.carlson@apple.com

12 edits in trunk

Update "manual" caption track logic
https://bugs.webkit.org/show_bug.cgi?id=154084
<rdar://problem/24530516>

Reviewed by Dean Jackson.

No new tests, media/track/track-manual-mode.html was updated.

English.lproj/Localizable.strings: Add new string.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::addTextTrack): track.setManualSelectionMode is no more.
(WebCore::HTMLMediaElement::configureTextTrackGroup): Never enable a track automatically when

in manual selection mode.

(WebCore::HTMLMediaElement::captionPreferencesChanged): track.setManualSelectionMode is no more.

html/track/TextTrack.cpp:

(WebCore::TextTrack::containsOnlyForcedSubtitles): Return true for forced tracks.
(WebCore::TextTrack::kind): Deleted.

html/track/TextTrack.h:

html/track/TrackBase.h:

(WebCore::TrackBase::kind): De-virtualize, nobody overrides it.

page/CaptionUserPreferencesMediaAF.cpp:

(WebCore::trackDisplayName): Include "forced" in the name of forced tracks.

platform/LocalizedStrings.cpp:

(WebCore::forcedTrackMenuItemText): New.

platform/LocalizedStrings.h:

4:03 PM Changeset in webkit [196400] by jiewen_tan@apple.com

100 edits in trunk/Source

Rename *Event::create* which creates events for bindings to *Event::createForBindings* and cleanup corresponding paths
https://bugs.webkit.org/show_bug.cgi?id=153903
<rdar://problem/24518146>

Reviewed by Darin Adler.

Source/WebCore:

Rename Event::create(const AtomicString&, const EventInit&) to Event::createForBindings
(const AtomicString&, const EventInit&) and for all the subclasses as well in order to
support Event.isTrusted. Besides, some of the subclasses use the create method for bindings
to create events not for bindings and vice versa. Therefore, this patch also cleanup
corresponding paths to ensure no misuse of the create mehtod. The same for Event::create()
as it is combined with Event::initEvent to create an event for bindings for legacy content.

After this patch, all call sites of *Event::create* are supposed to use *Event::create
to create events for user agent and *Event::createForBindings for bindings.

No change in behavior.

Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.h:

(WebCore::WebKitPlaybackTargetAvailabilityEvent::create):
(WebCore::WebKitPlaybackTargetAvailabilityEvent::createForBindings):
(WebCore::WebKitPlaybackTargetAvailabilityEventInit::WebKitPlaybackTargetAvailabilityEventInit): Deleted.

Modules/encryptedmedia/MediaKeyMessageEvent.cpp:

(WebCore::MediaKeyMessageEvent::MediaKeyMessageEvent):
(WebCore::MediaKeyMessageEventInit::MediaKeyMessageEventInit): Deleted.

Modules/encryptedmedia/MediaKeyMessageEvent.h:

(WebCore::MediaKeyMessageEvent::create):
(WebCore::MediaKeyMessageEvent::createForBindings):

Modules/encryptedmedia/MediaKeyNeededEvent.cpp:

(WebCore::MediaKeyNeededEvent::MediaKeyNeededEvent):
(WebCore::MediaKeyNeededEventInit::MediaKeyNeededEventInit): Deleted.

Modules/encryptedmedia/MediaKeyNeededEvent.h:

(WebCore::MediaKeyNeededEvent::create):
(WebCore::MediaKeyNeededEvent::createForBindings):

Modules/encryptedmedia/MediaKeySession.cpp:

(WebCore::MediaKeySession::sendMessage):

Modules/gamepad/GamepadEvent.h:

(WebCore::GamepadEvent::create):
(WebCore::GamepadEvent::createForBindings):
(WebCore::GamepadEventInit::GamepadEventInit): Deleted.

Modules/indieui/UIRequestEvent.cpp:

(WebCore::UIRequestEvent::createForBindings):
(WebCore::UIRequestEvent::UIRequestEvent):
(WebCore::UIRequestEventInit::UIRequestEventInit): Deleted.
(WebCore::UIRequestEvent::create): Deleted.

Modules/indieui/UIRequestEvent.h:
Modules/mediastream/MediaStreamEvent.cpp:

(WebCore::MediaStreamEvent::createForBindings):
(WebCore::MediaStreamEventInit::MediaStreamEventInit): Deleted.
(WebCore::MediaStreamEvent::create): Deleted.

Modules/mediastream/MediaStreamEvent.h:
Modules/mediastream/MediaStreamTrackEvent.cpp:

(WebCore::MediaStreamTrackEvent::createForBindings):
(WebCore::MediaStreamTrackEventInit::MediaStreamTrackEventInit): Deleted.
(WebCore::MediaStreamTrackEvent::create): Deleted.

Modules/mediastream/MediaStreamTrackEvent.h:
Modules/mediastream/RTCDTMFToneChangeEvent.cpp:

(WebCore::RTCDTMFToneChangeEvent::createForBindings):
(WebCore::RTCDTMFToneChangeEvent::create): Deleted.

Modules/mediastream/RTCDTMFToneChangeEvent.h:
Modules/mediastream/RTCDataChannelEvent.cpp:

(WebCore::RTCDataChannelEvent::createForBindings):
(WebCore::RTCDataChannelEvent::create): Deleted.

Modules/mediastream/RTCDataChannelEvent.h:
Modules/mediastream/RTCIceCandidateEvent.cpp:

(WebCore::RTCIceCandidateEvent::createForBindings):
(WebCore::RTCIceCandidateEvent::create): Deleted.

Modules/mediastream/RTCIceCandidateEvent.h:
Modules/mediastream/RTCTrackEvent.cpp:

(WebCore::RTCTrackEvent::createForBindings):
(WebCore::RTCTrackEventInit::RTCTrackEventInit): Deleted.
(WebCore::RTCTrackEvent::create): Deleted.

Modules/mediastream/RTCTrackEvent.h:
Modules/speech/SpeechSynthesisEvent.cpp:

(WebCore::SpeechSynthesisEvent::createForBindings):
(WebCore::SpeechSynthesisEvent::create):
(WebCore::SpeechSynthesisEvent::SpeechSynthesisEvent):

Modules/speech/SpeechSynthesisEvent.h:
Modules/webaudio/AudioProcessingEvent.cpp:

(WebCore::AudioProcessingEvent::create): Deleted.

Modules/webaudio/AudioProcessingEvent.h:

(WebCore::AudioProcessingEvent::create):
(WebCore::AudioProcessingEvent::createForBindings):

Modules/webaudio/OfflineAudioCompletionEvent.cpp:

(WebCore::OfflineAudioCompletionEvent::createForBindings):
(WebCore::OfflineAudioCompletionEvent::create): Deleted.

Modules/webaudio/OfflineAudioCompletionEvent.h:
Modules/websockets/CloseEvent.h:

(WebCore::CloseEvent::create):
(WebCore::CloseEvent::createForBindings):
(WebCore::CloseEvent::CloseEvent):
(WebCore::CloseEventInit::CloseEventInit): Deleted.

bindings/objc/DOM.mm:

(-[DOMNode nextFocusNode]):
(-[DOMNode previousFocusNode]):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateConstructorDefinition):

dom/AnimationEvent.cpp:

(WebCore::AnimationEventInit::AnimationEventInit): Deleted.

dom/AnimationEvent.h:
dom/BeforeLoadEvent.h:

(WebCore::BeforeLoadEventInit::BeforeLoadEventInit): Deleted.

dom/ClipboardEvent.h:
dom/CompositionEvent.cpp:

(WebCore::CompositionEventInit::CompositionEventInit): Deleted.

dom/CompositionEvent.h:
dom/CustomEvent.cpp:

(WebCore::CustomEventInit::CustomEventInit): Deleted.

dom/CustomEvent.h:
dom/DeviceMotionEvent.h:
dom/DeviceOrientationEvent.h:
dom/Document.cpp:

(WebCore::Document::createEvent):

dom/Element.cpp:

(WebCore::Element::dispatchMouseEvent):

dom/ErrorEvent.cpp:

(WebCore::ErrorEventInit::ErrorEventInit): Deleted.

dom/ErrorEvent.h:
dom/Event.cpp:

(WebCore::EventInit::EventInit): Deleted.

dom/Event.h:

(WebCore::Event::createForBindings):
(WebCore::Event::create): Deleted.

dom/FocusEvent.cpp:

(WebCore::FocusEventInit::FocusEventInit): Deleted.

dom/FocusEvent.h:
dom/HashChangeEvent.h:

(WebCore::HashChangeEventInit::HashChangeEventInit): Deleted.

dom/KeyboardEvent.cpp:

(WebCore::KeyboardEvent::KeyboardEvent):
(WebCore::KeyboardEventInit::KeyboardEventInit): Deleted.

dom/KeyboardEvent.h:
dom/MessageEvent.cpp:

(WebCore::MessageEvent::MessageEvent):
(WebCore::MessageEventInit::MessageEventInit): Deleted.

dom/MessageEvent.h:
dom/MouseEvent.cpp:

(WebCore::MouseEvent::createForBindings):
(WebCore::MouseEvent::create):
(WebCore::MouseEvent::MouseEvent):
(WebCore::MouseEvent::cloneFor):
(WebCore::MouseEventInit::MouseEventInit): Deleted.

dom/MouseEvent.h:

(WebCore::MouseEvent::createForBindings):
(WebCore::MouseEvent::create): Deleted.

dom/MouseRelatedEvent.cpp:

(WebCore::MouseRelatedEvent::MouseRelatedEvent):
(WebCore::MouseRelatedEvent::init):

dom/MouseRelatedEvent.h:

(WebCore::MouseRelatedEvent::screenX):
(WebCore::MouseRelatedEvent::screenY):
(WebCore::MouseRelatedEvent::screenLocation):
(WebCore::MouseRelatedEvent::clientX):
(WebCore::MouseRelatedEvent::clientY):
(WebCore::MouseRelatedEvent::movementX):
(WebCore::MouseRelatedEvent::movementY):
(WebCore::MouseRelatedEvent::clientLocation):
(WebCore::MouseRelatedEvent::isSimulated):
(WebCore::MouseRelatedEvent::absoluteLocation):
(WebCore::MouseRelatedEvent::setAbsoluteLocation):

dom/MutationEvent.h:
dom/OverflowEvent.cpp:

(WebCore::OverflowEvent::OverflowEvent):
(WebCore::OverflowEvent::initOverflowEvent):
(WebCore::OverflowEventInit::OverflowEventInit): Deleted.

dom/OverflowEvent.h:
dom/PageTransitionEvent.cpp:

(WebCore::PageTransitionEventInit::PageTransitionEventInit): Deleted.

dom/PageTransitionEvent.h:
dom/PopStateEvent.cpp:

(WebCore::PopStateEvent::createForBindings):
(WebCore::PopStateEventInit::PopStateEventInit): Deleted.
(WebCore::PopStateEvent::PopStateEvent): Deleted.
(WebCore::PopStateEvent::create): Deleted.

dom/PopStateEvent.h:
dom/ProgressEvent.cpp:

(WebCore::ProgressEventInit::ProgressEventInit): Deleted.

dom/ProgressEvent.h:

(WebCore::ProgressEvent::createForBindings):
(WebCore::ProgressEvent::create): Deleted.

dom/SecurityPolicyViolationEvent.h:

(WebCore::SecurityPolicyViolationEventInit::SecurityPolicyViolationEventInit): Deleted.

dom/TextEvent.cpp:

(WebCore::TextEvent::createForBindings):
(WebCore::TextEvent::create): Deleted.

dom/TextEvent.h:
dom/TouchEvent.h:
dom/TransitionEvent.cpp:

(WebCore::TransitionEventInit::TransitionEventInit): Deleted.

dom/TransitionEvent.h:
dom/UIEvent.cpp:

(WebCore::UIEventInit::UIEventInit): Deleted.

dom/UIEvent.h:

(WebCore::UIEvent::createForBindings):
(WebCore::UIEvent::create): Deleted.

dom/UIEventWithKeyState.h:

(WebCore::UIEventWithKeyState::ctrlKey):
(WebCore::UIEventWithKeyState::shiftKey):
(WebCore::UIEventWithKeyState::altKey):
(WebCore::UIEventWithKeyState::metaKey):
(WebCore::UIEventWithKeyState::UIEventWithKeyState):

dom/WebKitAnimationEvent.cpp:

(WebCore::WebKitAnimationEventInit::WebKitAnimationEventInit): Deleted.

dom/WebKitAnimationEvent.h:
dom/WebKitTransitionEvent.cpp:

(WebCore::WebKitTransitionEventInit::WebKitTransitionEventInit): Deleted.

dom/WebKitTransitionEvent.h:
dom/WheelEvent.h:
html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::mediaPlayerKeyAdded):
(WebCore::HTMLMediaElement::mediaPlayerKeyError):
(WebCore::HTMLMediaElement::mediaPlayerKeyMessage):
(WebCore::HTMLMediaElement::mediaPlayerKeyNeeded):

html/MediaKeyEvent.cpp:

(WebCore::MediaKeyEvent::MediaKeyEvent):
(WebCore::MediaKeyEventInit::MediaKeyEventInit): Deleted.

html/MediaKeyEvent.h:
html/canvas/WebGLContextEvent.cpp:

(WebCore::WebGLContextEventInit::WebGLContextEventInit): Deleted.

html/canvas/WebGLContextEvent.h:
html/track/TrackEvent.cpp:

(WebCore::TrackEvent::TrackEvent):
(WebCore::TrackEventInit::TrackEventInit): Deleted.

html/track/TrackEvent.h:
html/track/TrackListBase.cpp:

(TrackListBase::scheduleTrackEvent):
(TrackListBase::scheduleChangeEvent):

page/EventSource.cpp:

(WebCore::EventSource::createMessageEvent):

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation):
(WebCore::gatherSecurityPolicyViolationEventData): Deleted.

storage/StorageEvent.cpp:

(WebCore::StorageEvent::createForBindings):
(WebCore::StorageEventInit::StorageEventInit): Deleted.
(WebCore::StorageEvent::create): Deleted.

storage/StorageEvent.h:
svg/SVGZoomEvent.h:

(WebCore::SVGZoomEvent::createForBindings):
(WebCore::SVGZoomEvent::create): Deleted.

xml/XMLHttpRequestProgressEvent.h:

(WebCore::XMLHttpRequestProgressEvent::createForBindings):
(WebCore::XMLHttpRequestProgressEvent::create): Deleted.

Source/WebKit2:

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::nextAssistableElement):

3:57 PM Changeset in webkit [196399] by andersca@apple.com

8 edits in trunk/Source/WebKit2

Add SPI to remove individual user scripts or user style sheets
https://bugs.webkit.org/show_bug.cgi?id=154046
rdar://problem/23596352

Reviewed by Sam Weinig.

UIProcess/API/Cocoa/WKUserContentController.mm:

(-[WKUserContentController _removeUserScript:]):
(-[WKUserContentController _userStyleSheets]):
(-[WKUserContentController _addUserStyleSheet:]):
(-[WKUserContentController _removeUserStyleSheet:]):

UIProcess/API/Cocoa/WKUserContentControllerPrivate.h:
UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::WebUserContentControllerProxy):
(WebKit::WebUserContentControllerProxy::addProcess):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeAllUserStyleSheets):

UIProcess/UserContent/WebUserContentControllerProxy.h:

(WebKit::WebUserContentControllerProxy::userStyleSheets):

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::removeUserScript):
(WebKit::WebUserContentController::removeUserStyleSheet):

WebProcess/UserContent/WebUserContentController.h:
WebProcess/UserContent/WebUserContentController.messages.in:

3:31 PM Changeset in webkit [196398] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after 196392

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

3:02 PM Changeset in webkit [196397] by mark.lam@apple.com

3 edits in trunk/Source/WTF

Changed WTFCrash to not trash the crash site register state.
https://bugs.webkit.org/show_bug.cgi?id=153996

Reviewed by Geoffrey Garen.

When doing post-mortem crash site analysis using data from crash reports, it is
immensely valuable to be able to infer the crashing program's state from the
register values at crash time. However, for RELEASE_ASSERT failures, we crash
using WTFCrash(), and WTFCrash() is currently implemented as a function call
that, in turn, calls a lot of other functions to do crash handling before
actually crashing. As a result, the register values captured in the crash
reports are not likely to still contain the values used by the caller function
that failed the RELEASE_ASSERT.

This patch aims to remedy this issue for non-debug builds on OS(DARWIN) ports.
It does so by changing WTFCrash() into an inlined function that has an inlined
asm statement to issues the CPU specific breakpoint trap instruction. As a
result, for non-debug OS(DARWIN) builds, crashes due to failed RELEASE_ASSERTs
will now show up in crash reports as crashing due to EXC_BREAKPOINT (SIGTRAP)
instead of a EXC_BAD_ACCESS (SIGSEGV) on address 0xbbadbeef.

For debug and non-DARWIN builds, WTFCrash() behavior currently remains unchanged.

wtf/Assertions.cpp:
wtf/Assertions.h:

2:50 PM Changeset in webkit [196396] by Ryan Haddad

22 edits in trunk/Source/WebCore

Rebaselining bindings tests

Unreviewed test gardening.

No new tests needed.

bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
bindings/scripts/test/JS/JSTestCallback.cpp:
bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
bindings/scripts/test/JS/JSTestEventConstructor.cpp:
bindings/scripts/test/JS/JSTestEventTarget.cpp:
bindings/scripts/test/JS/JSTestException.cpp:
bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
bindings/scripts/test/JS/JSTestInterface.cpp:
bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
bindings/scripts/test/JS/JSTestNondeterministic.cpp:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
bindings/scripts/test/JS/JSTestTypedefs.cpp:
bindings/scripts/test/JS/JSattribute.cpp:
bindings/scripts/test/JS/JSreadonly.cpp:

2:16 PM Changeset in webkit [196395] by mark.lam@apple.com

2 edits in trunk/Source/WebKit/mac

WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture: should assert that it is being called from the "main" thread.
https://bugs.webkit.org/show_bug.cgi?id=154059

Reviewed by Geoffrey Garen.

This makes it so that misbehaving clients which call it (indirectly) from another
thread (not the main thread) will fail faster. Otherwise, we get potential
memory corruption that results in strange crashes elsewhere later.

WebView/WebFrame.mm:

(-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):

2:01 PM Changeset in webkit [196394] by commit-queue@webkit.org

5 edits
1 add in trunk/Source/WebCore

[cmake] Consolidate CMake code related to image decoders.
https://bugs.webkit.org/show_bug.cgi?id=154074

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-10
Reviewed by Alex Christensen.

Common image decoder sources, includes and libs are moved to
platform/ImageDecoders.cmake.

Also, added include directories of libjpeg and libpng to
WebCore_SYSTEM_INCLUDE_DIRECTORIES.

No new tests needed.

CMakeLists.txt: Moved common include paths to ImageDecoders.cmake.
PlatformEfl.cmake: Moved common sources and libs to ImageDecoders.cmake.
PlatformGTK.cmake: Ditto.
PlatformWinCairo.cmake: Moved common sources to ImageDecoders.cmake.
platform/ImageDecoders.cmake: Added.

1:57 PM Changeset in webkit [196393] by mmaxfield@apple.com

4 edits in trunk/Source/WebCore

CSSSegmentedFontFace does not need to be reference counted
https://bugs.webkit.org/show_bug.cgi?id=154083

Reviewed by Antti Koivisto.

...There is only ever a single reference to one.

No new tests because there is no behavior change.

css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::getFontFace):

css/CSSFontSelector.h:
css/CSSSegmentedFontFace.h:

(WebCore::CSSSegmentedFontFace::create): Deleted.

1:51 PM Changeset in webkit [196392] by Chris Dumez

107 edits
2 adds in trunk

[Web IDL] interface objects should be Function objects
https://bugs.webkit.org/show_bug.cgi?id=154038
<rdar://problem/24569358>

Reviewed by Geoffrey Garen.

LayoutTests/imported/w3c:

Rebaseline W3C tests now that more checks are passing. Some checks still
fail because a lot of our interfaces should inherit EventTarget and
currently don't (they duplicate the EventTarget API instead).

Also, as per WebIDL, window.NodeFilter's proto should be ObjectPrototype
instead of FunctionPrototype but this is an exceptional case and our new
behavior is consistent with Firefox and Chrome.

web-platform-tests/XMLHttpRequest/interfaces-expected.txt:
web-platform-tests/dom/events/Event-constructors-expected.txt:
web-platform-tests/dom/historical-expected.txt:
web-platform-tests/dom/interfaces-expected.txt:
web-platform-tests/fetch/api/headers/headers-idl-expected.txt:
web-platform-tests/fetch/api/request/request-idl-expected.txt:
web-platform-tests/html/dom/interfaces-expected.txt:
web-platform-tests/html/semantics/embedded-content/the-audio-element/audio_constructor-expected.txt:

Source/JavaScriptCore:

Update functionProtoFuncToString() to handle JSObjects that
have the TypeOfShouldCallGetCallData flag and are callable,
as these behave like functions and use ClassInfo::className()
as function name in this case.

runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncToString):

Source/WebCore:

interface objects should be Function objects as per Web IDL:

So window.Event should be a Function object for e.g. but in WebKit it
is a regular EventConstructor JSObject.
Firefox and Chrome match the specification.

Test: js/interface-objects.html

bindings/js/JSDOMBinding.cpp:

(WebCore::callThrowTypeError):
(WebCore::DOMConstructorObject::getCallData):
When calling the interface object as a function, we throw a TypeError
with a message asking to use the 'new' operator to match the behavior
of Firefox and Chrome.

bindings/js/JSDOMBinding.h:

Add JSC::TypeOfShouldCallGetCallData structure flag and implement
getCallData() so that typeof returns "function", as per the
specification and the behavior of other browsers.

(WebCore::DOMConstructorObject::className):
Implement className() and return "Function" to match the specification and
other browsers. Otherwise, it would fall back to using ClassInfo::className
which os the function name and interface name (e.g. "Event").

bindings/js/JSDOMConstructor.h:

(WebCore::JSDOMConstructorNotConstructable::callThrowTypeError):
(WebCore::JSDOMConstructorNotConstructable::getCallData):
As per the specification, interfaces that do not have a [Constructor]
should throw a TypeError when called as a function. Use the "Illegal
constructor" error message to match Firefox and Chrome.

bindings/js/JSDOMGlobalObject.h:

(WebCore::getDOMConstructor):
Instead of using objectPrototype as prototype for all DOM constructors,
we now call the prototypeForStructure() static function that is
generated for each bindings class. As per the Web IDL specification,
The Prototype internal property of an interface object for a
non-callback interface is determined as follows:

If the interface inherits from some other interface, the value of Prototype is the interface object for that other interface.
If the interface doesn't inherit from any other interface, the value of Prototype is %FunctionPrototype% ([ECMA-262], section 6.1.7.4).

bindings/js/JSImageConstructor.cpp:

(WebCore::JSImageConstructor::prototypeForStructure):
Have the Image's interface object use HTMLElement's interface object
as prototype as HTMLImageElement inherits HTMLElement.

bindings/scripts/CodeGenerator.pm:

(getInterfaceExtendedAttributesFromName):
Add a utility function to cheaply retrieve an interface's IDL extended
attributes without actually parsing the IDL. This is used to check if
an interface's parent is marked as [NoInterfaceObject] currently.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateImplementation):
(GenerateCallbackHeader):
(GenerateCallbackImplementation):
Mark JSGlobalObject* parameter as const as the implementation does not
alter the globalObject.

(GenerateConstructorHelperMethods):

Generate prototypeForStructure() function for each bindings class that is not marked as [NoInterfaceObject] so getDOMConstructor() knows which prototype to use for the interface object / constructor when constructing it.
Use the interface name for the interface object, without the "Constructor" suffix, to match the behavior of Firefox and Chrome.

bindings/scripts/test/*:

Rebaseline bindings tests.

LayoutTests:

Rebaseline / update existing layout tests now that interface objects
are now Function objects. Also add a layout test to cover various
aspects of interface objects.

css3/blending/background-blend-mode-property-parsing-expected.txt:
css3/blending/blend-mode-property-parsing-expected.txt:
css3/blending/script-tests/background-blend-mode-property-parsing.js:

(shouldBeType):

css3/blending/script-tests/blend-mode-property-parsing.js:

(shouldBeType):

css3/filters/backdrop/backdropfilter-property-parsing-expected.txt:
css3/filters/backdrop/script-tests/backdropfilter-property-parsing.js:

(shouldBeType):

css3/filters/filter-property-parsing-expected.txt:
css3/filters/script-tests/filter-property-parsing.js:

(shouldBeType):

fast/css/image-set-parsing-expected.txt:
fast/css/script-tests/image-set-parsing.js:

(shouldBeType):

fast/dom/DOMException/XPathException-expected.txt:
fast/dom/DOMException/prototype-object-expected.txt:
fast/dom/DOMException/prototype-object.html:
fast/dom/DOMException/resources/XPathException.js:
fast/dom/MutationObserver/mutation-record-constructor-expected.txt:
fast/dom/MutationObserver/mutation-record-constructor.html:
fast/dom/Window/element-constructors-on-window-expected.txt:
fast/dom/call-a-constructor-as-a-function-expected.txt:
fast/dom/constructor-proto-expected.txt:
fast/dom/constructor-proto.html:
fast/dom/wrapper-classes-expected.txt:
fast/dom/wrapper-classes.html:
fast/mediastream/MediaStreamConstructor-expected.txt:
fast/mediastream/MediaStreamConstructor.html:
fast/workers/constructor-proto-expected.txt:
fast/workers/worker-location-expected.txt:
http/tests/xmlhttprequest/XMLHttpRequestException-expected.txt:
http/tests/xmlhttprequest/XMLHttpRequestException.html:
js/dom/global-constructors-attributes-dedicated-worker-expected.txt:
js/dom/script-tests/global-constructors-attributes-idb.js:

(constructorPropertiesOnGlobalObject):

js/dom/script-tests/global-constructors-attributes.js:

(constructorPropertiesOnGlobalObject):

js/interface-objects-expected.txt: Added.
js/interface-objects.html: Added.
media/encrypted-media/encrypted-media-v2-syntax-expected.txt:
media/encrypted-media/encrypted-media-v2-syntax.html:
media/track/track-vttcue-expected.txt:
platform/mac/fast/dom/Window/window-lookup-precedence-expected.txt:
platform/mac/js/dom/global-constructors-attributes-expected.txt:
svg/custom/SVGException-expected.txt:
svg/custom/global-constructors-expected.txt:
svg/custom/script-tests/SVGException.js:
svg/custom/script-tests/global-constructors.js:

(shouldBeDefined):

transforms/2d/transform-value-types-expected.txt:
transforms/2d/transform-value-types.html:

1:45 PM Changeset in webkit [196391] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

[Mac] Graphical corruption in videos when enabling custom loading path
https://bugs.webkit.org/show_bug.cgi?id=154044

Reviewed by Alex Christensen.

Revert the "Drive-by fix" in r196345 as it breaks the WebCoreNSURLSessionTests.BasicOperation API test.

platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):

1:18 PM Changeset in webkit [196390] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

Removed the duplicated definition of ChartPaneBase.

public/v3/components/chart-pane-base.js:

1:10 PM Changeset in webkit [196389] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking fast/css-generated-content/details-summary-before-after.html as failing on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=153029

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

1:07 PM Changeset in webkit [196388] by mmaxfield@apple.com

4 edits in trunk/Source/WebCore

CSSSegmentedFontFace does not need to be reference counted
https://bugs.webkit.org/show_bug.cgi?id=154083

Reviewed by Antti Koivisto.

...There is only ever a single reference to one.

No new tests because there is no behavior change.

css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::getFontFace):

css/CSSFontSelector.h:
css/CSSSegmentedFontFace.h:

(WebCore::CSSSegmentedFontFace::create): Deleted.

1:07 PM Changeset in webkit [196387] by rniwa@webkit.org

9 edits
1 move
1 add in trunk/Websites/perf.webkit.org

Analysis task page on v3 UI should show charts
https://bugs.webkit.org/show_bug.cgi?id=154057

Reviewed by Chris Dumez.

Extracted ChartPaneBase out of ChartPane and added an instance of its new subclass, AnalysisTaskChartPane,
to the analysis task page. The main difference is that ChartPaneBase doesn't depend on the presence of
this._chartsPage unlike ChartPane. It also doesn't have the header with toolbar (to show breakdown, etc...).

public/v3/components/base.js:

(ComponentBase.prototype._constructShadowTree): Call htmlTemplate() and cssTemplate() with the right "this".

public/v3/components/chart-pane-base.js: Added.

(ChartPaneBase): Extracted from ChartPane.
(ChartPaneBase.prototype.configure): Extracted from the constructor. Separating this function allows the
component to be instantiated inside a HTML template.
(ChartPaneBase.prototype._fetchAnalysisTasks): Moved from ChartPane._fetchAnalysisTasks.
(ChartPaneBase.prototype.platformId): Ditto.
(ChartPaneBase.prototype.metricId): Ditto.
(ChartPaneBase.prototype.setOverviewDomain): Ditto.
(ChartPaneBase.prototype.setMainDomain): Ditto.
(ChartPaneBase.prototype._overviewSelectionDidChange): Extracted from the constructor. This is overridden in
ChartPane and unused in AnalysisTaskChartPane.
(ChartPaneBase.prototype._mainSelectionDidChange): Extracted from ChartPane._mainSelectionDidChange.
(ChartPaneBase.prototype._mainSelectionDidZoom): Extracted from ChartPane._mainSelectionDidZoom.
(ChartPaneBase.prototype._indicatorDidChange): Extracted from ChartPane._indicatorDidChange.
(ChartPaneBase.prototype._didFetchData): Moved from ChartPane._fetchAnalysisTasks.
(ChartPaneBase.prototype._openAnalysisTask): Ditto.
(ChartPaneBase.prototype._openCommitViewer): Ditto. Also fixed a bug that we don't show the spinner while
waiting for the data to be fetched by calling this.render() here.
(ChartPaneBase.prototype._keyup): Moved from ChartPane._keyup. Also fixed the bug that the revisions list
doesn't update by calling this.render() here.
(ChartPaneBase.prototype.render): Extracted from ChartPane.render.
(ChartPaneBase.htmlTemplate): Extracted from ChartPane.htmlTemplate.
(ChartPaneBase.paneHeaderTemplate): Added. This is overridden in ChartPane and unused in AnalysisTaskChartPane.
(ChartPaneBase.cssTemplate): Extracted from ChartPane.htmlTemplate.

public/v3/components/chart-styles.js: Renamed from public/v3/pages/page-with-charts.js.

(PageWithCharts): Renamed from PageWithCharts since it no longer extends PageWithHeading.
(ChartStyles.createChartSourceList):

public/v3/components/commit-log-viewer.js:

(CommitLogViewer.prototype.view): Set this._repository right away instead of waiting for the fetched data
so that spinner will be shown while the data is being fetched.

public/v3/index.html:

public/v3/pages/analysis-task-page.js:

(AnalysisTaskChartPane): Added extends ChartPaneBase.
(AnalysisTaskPage): Added. this._chartPane.
(AnalysisTaskPage.prototype._didFetchTask): Initialize this._chartPane with a domain.
(AnalysisTaskPage.prototype.render): Render this._chartPane.
(AnalysisTaskPage.htmlTemplate):

public/v3/pages/chart-pane-status-view.js:

(ChartPaneStatusView): Removed the unused router from the argument list.
(ChartPaneStatusView.prototype.pointsRangeForAnalysis): Renamed from analyzeData() since it was ambiguous.
(ChartPaneStatusView.prototype.moveRepositoryWithNotification): Fixed the bug that we don't update the list
of the revisions here.
(ChartPaneStatusView.prototype.computeChartStatusLabels):

public/v3/pages/chart-pane.js:

(ChartPane): Now extends ChartPaneBase.
(ChartPane.prototype._overviewSelectionDidChange): Extracted from the constructor.
(ChartPane.prototype._mainSelectionDidChange):
(ChartPane.prototype._mainSelectionDidZoom):
(ChartPane.prototype._indicatorDidChange):
(ChartPane.prototype.render):
(ChartPane.prototype._renderActionToolbar):
(ChartPane.paneHeaderTemplate): Extracted from htmlTemplate.
(ChartPane.cssTemplate):
(ChartPane.overviewOptions.selection.onchange): Deleted.
(ChartPane.prototype._fetchAnalysisTasks): Deleted.
(ChartPane.prototype.platformId): Deleted.
(ChartPane.prototype.metricId): Deleted.
(ChartPane.prototype.setOverviewDomain): Deleted.
(ChartPane.prototype.setMainDomain): Deleted.
(ChartPane.prototype._openCommitViewer): Deleted.
(ChartPane.prototype._didFetchData): Deleted.
(ChartPane.prototype._keyup): Deleted.

public/v3/pages/charts-page.js:

(ChartsPage):
(ChartsPage.createDomainForAnalysisTask): Extracted by createDomainForAnalysisTask; used to set the domain
of the charts in the analysis task page.
(ChartsPage.createStateForAnalysisTask):

public/v3/pages/dashboard-page.js:

(DashboardPage):
(DashboardPage.prototype._createChartForCell):

1:05 PM Changeset in webkit [196386] by rniwa@webkit.org

4 edits in trunk/Websites/perf.webkit.org

Add the support for maintenance mode
https://bugs.webkit.org/show_bug.cgi?id=154072

Reviewed by Chris Dumez.

Added the crude support for maintenance mode whereby which the reports are stored in the filesystem
instead of the database.

config.json: Added maintenanceMode and maintenanceDirectory as well as forgotten siteTitle and

remoteServer.httpdMutexDir.

public/api/report.php:

(main): Don't connect to the database or modify database when maintenanceMode is set.

public/include/json-header.php:

(ensure_privileged_api_data): Exit with InMaintenanceMode when maintenanceMode is set. This prevents
privileged API such as creating analysis tasks and new A/B testing groups from modifying the database.

12:56 PM Changeset in webkit [196385] by Ryan Haddad

2 edits in trunk/LayoutTests

Reaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196374

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

12:56 PM Changeset in webkit [196384] by achristensen@apple.com

8 edits in trunk/Source/WebKit2

Fix assertions when loading from WebProcess
https://bugs.webkit.org/show_bug.cgi?id=154079

Reviewed by Anders Carlsson.

Assertions were failing, mostly when using NetworkProcess, and mostly involving Top Sites.
When we do loading from the WebProcess (which we should eventually not allow), we were sometimes
using a private browsing session that did not exist because the UIProcess had told the NetworkProcess
to create a private browsing session with the given SessionID, but the WebProcess was not told about
the private browsing session.
Also, sometimes we were calling NetworkProcess::singleton() from the WebProcess, which caused problems
with the PlatformStrategies object being reset. This prevents that, too.

NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad):
Added an assertion that we have a network session when we have just made a NetworkingContext with the given SessionID.

NetworkProcess/NetworkSession.h:
NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::NetworkSession::defaultSession):
(WebKit::NetworkSession::NetworkSession):

NetworkProcess/mac/RemoteNetworkingContext.mm:

(WebKit::RemoteNetworkingContext::ensurePrivateBrowsingSession):
Call NetworkProcess::singleton only when we know we are in the network process.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::WebPageProxy):

WebProcess/WebCoreSupport/mac/WebFrameNetworkingContext.mm:

(WebKit::WebFrameNetworkingContext::ensurePrivateBrowsingSession):
Tell the WebProcesses about the new private session, too. Sometimes they use the new private session.

WebProcess/WebProcess.cpp:

(WebKit::WebProcess::ensurePrivateBrowsingSession):
(WebKit::WebProcess::destroyPrivateBrowsingSession):
Removed useless macros that were always true for all WK2 clients.

12:47 PM Changeset in webkit [196383] by Antti Koivisto

13 edits in trunk/Source/WebCore

Optimize style invalidation after class attribute change
https://bugs.webkit.org/show_bug.cgi?id=154075
rdar://problem/12526450

Reviewed by Andreas Kling.

Currently a class attribute change invalidates style for the entire element subtree for any class found in the
active stylesheet set.

This patch optimizes class changes by building a new optimization structure called ancestorClassRules. It contains
rules that have class selectors in the portion of the complex selector that matches ancestor elements. The sets
of rules are hashes by the class name.

On class attribute change the existing StyleInvalidationAnalysis mechanism is used with ancestorClassRules to invalidate
exactly those descendants that are affected by the addition or removal of the class name. This is fast because the CSS JIT
makes selector matching cheap and the number of relevant rules is typically small.

This optimization is very effective on many dynamic pages. For example when focusing and unfocusing the web inspector it
cuts down the number of resolved elements from ~1000 to ~50. Even in PLT it reduces the number of resolved elements by ~11%.

css/DocumentRuleSets.cpp:

(WebCore::DocumentRuleSets::collectFeatures):
(WebCore::DocumentRuleSets::ancestorClassRules):

Create optimization RuleSets on-demand when there is an actual dynamic class change.

css/DocumentRuleSets.h:

(WebCore::DocumentRuleSets::features):
(WebCore::DocumentRuleSets::sibling):
(WebCore::DocumentRuleSets::uncommonAttribute):

css/ElementRuleCollector.cpp:

(WebCore::ElementRuleCollector::ElementRuleCollector):

Add a new constructor that doesn't requires DocumentRuleSets. Only the user and author style is required.

(WebCore::ElementRuleCollector::matchAuthorRules):
(WebCore::ElementRuleCollector::matchUserRules):

css/ElementRuleCollector.h:
css/RuleFeature.cpp:

(WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):

Collect class names that show up in the ancestor portion of the selector.
Make this a member.

(WebCore::RuleFeatureSet::collectFeatures):

Move this code from RuleData.
Add the rule to ancestorClassRules if needed.

(WebCore::RuleFeatureSet::add):
(WebCore::RuleFeatureSet::clear):
(WebCore::RuleFeatureSet::shrinkToFit):
(WebCore::recursivelyCollectFeaturesFromSelector): Deleted.
(WebCore::RuleFeatureSet::collectFeaturesFromSelector): Deleted.

css/RuleFeature.h:

(WebCore::RuleFeature::RuleFeature):
(WebCore::RuleFeatureSet::RuleFeatureSet): Deleted.

css/RuleSet.cpp:

(WebCore::RuleData::RuleData):
(WebCore::RuleSet::RuleSet):
(WebCore::RuleSet::~RuleSet):
(WebCore::RuleSet::addToRuleSet):
(WebCore::RuleSet::addRule):
(WebCore::RuleSet::addRulesFromSheet):
(WebCore::collectFeaturesFromRuleData): Deleted.

css/RuleSet.h:

(WebCore::RuleSet::tagRules):
(WebCore::RuleSet::RuleSet): Deleted.

css/StyleInvalidationAnalysis.cpp:

(WebCore::shouldDirtyAllStyle):
(WebCore::StyleInvalidationAnalysis::StyleInvalidationAnalysis):

Add a new constructor that takes a ready made RuleSet instead of a stylesheet.

(WebCore::StyleInvalidationAnalysis::invalidateIfNeeded):
(WebCore::StyleInvalidationAnalysis::invalidateStyleForTree):
(WebCore::StyleInvalidationAnalysis::invalidateStyle):
(WebCore::StyleInvalidationAnalysis::invalidateStyle):

New function for invalidating a subtree instead of the whole document.

css/StyleInvalidationAnalysis.h:

(WebCore::StyleInvalidationAnalysis::dirtiesAllStyle):
(WebCore::StyleInvalidationAnalysis::hasShadowPseudoElementRulesInAuthorSheet):

dom/Element.cpp:

(WebCore::classStringHasClassName):
(WebCore::collectClasses):
(WebCore::computeClassChange):

Factor to return the changed classes.

(WebCore::invalidateStyleForClassChange):

First filter out classes that don't show up in stylesheets. If something remains invalidate the current
element for inline style change (that is a style change that doesn't affect descendants).

Next check if there are any ancestorClassRules for the changed class. If so use the StyleInvalidationAnalysis
to find any affected descendants and invalidate them with inline style change as well.

(WebCore::Element::classAttributeChanged):

Invalidate for removed classes before setting new attribute value, invalidate for added classes afterwards.

(WebCore::Element::absoluteLinkURL):
(WebCore::checkSelectorForClassChange): Deleted.

dom/ElementData.h:

(WebCore::ElementData::setClassNames):
(WebCore::ElementData::classNames):
(WebCore::ElementData::classNamesMemoryOffset):
(WebCore::ElementData::clearClass): Deleted.
(WebCore::ElementData::setClass): Deleted.

12:46 PM Changeset in webkit [196382] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.6/Source/WebKit

Merged r196377. rdar://problem/24584417

12:45 PM Changeset in webkit [196381] by Said Abou-Hallawa

6 edits in trunk/PerformanceTests

Add internal benchmark tests for CSS mix-blend-modes and filters
https://bugs.webkit.org/show_bug.cgi?id=154058

Provisionally reviewed by Jon Lee.

Animometer/resources/debug-runner/tests.js: Include the new tests in the

"HTML suite" of the debug runner.

Animometer/resources/extensions.js:

(Utilities.browserPrefix):
(Utilities.setElementPrefixedProperty): Utility functions to allow setting
prefixed style properties.

Animometer/tests/bouncing-particles/resources/bouncing-css-shapes.js:

Set the mix-blend-mode and the filter to some random values if the options
of the test requested that.

Animometer/tests/bouncing-particles/resources/bouncing-particles.js:

(parseShapeParameters): Parse the url options "blend" and "filter" and set
the corresponding flags.

Animometer/tests/resources/main.js:

(randomStyleMixBlendMode):
(randomStyleFilter): Return random mix-blend-mode and filter.

12:33 PM Changeset in webkit [196380] by matthew_hanson@apple.com

3 edits in branches/safari-601-branch/Source/WebCore

Merge r196226. rdar://problem/24417430

12:33 PM Changeset in webkit [196379] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/Source/WebCore

Merge r196208. rdar://problem/24417430

12:33 PM Changeset in webkit [196378] by matthew_hanson@apple.com

2 edits in branches/safari-601-branch/Source/WebCore

Merge r196206. rdar://problem/24417430

11:56 AM Changeset in webkit [196377] by achristensen@apple.com

2 edits in trunk/Source/WebKit

Fix internal Windows build
https://bugs.webkit.org/show_bug.cgi?id=154080
rdar://problem/24584417

Reviewed by Brent Fulgham.

CMakeLists.txt:

Explicitly make WebKit dependent on WebKitGUID so that WebKit will not start building
before WebKitGUID is finished generating and copying all headers, including WebKit/WebKit.h.

11:54 AM Changeset in webkit [196376] by mmaxfield@apple.com

3 edits in trunk/Source/WebCore

Addressing post-review comments after r196322

Unreviwed.

css/CSSFontFaceSource.cpp:

(WebCore::CSSFontFaceSource::font):

css/CSSFontFaceSource.h:

11:53 AM Changeset in webkit [196375] by bshafiei@apple.com

2 edits in branches/safari-601-branch/Source/WebInspectorUI

Merge patch for rdar://problem/24267980.

11:47 AM Changeset in webkit [196374] by Chris Dumez

17 edits
5 adds in trunk

Attributes on the Window instance should be configurable unless [Unforgeable]
https://bugs.webkit.org/show_bug.cgi?id=153920
<rdar://problem/24563211>

Reviewed by Darin Adler.

Source/JavaScriptCore:

Marking the Window instance attributes as configurable but cause
getOwnPropertyDescriptor() to report them as configurable, as
expected. However, trying to delete them would actually lead to
unexpected behavior because:

We did not reify custom accessor properties (most of the Window properties are custom accessors) upon deletion.
For non-reified static properties marked as configurable, JSObject::deleteProperty() would attempt to call the property setter with undefined. As a result, calling delete window.name would cause window.name to become the string "undefined" instead of the undefined value.

runtime/JSObject.cpp:

(JSC::getClassPropertyNames):
Now that we reify ALL properties, we only need to check the property table
if we have not reified. As a result, I dropped the 'didReify' parameter for
this function and instead only call this function if we have not yet reified.

(JSC::JSObject::putInlineSlow):
Only call putEntry() if we have not reified: Drop the

!(entry->attributes() & BuiltinOrFunctionOrAccessor)'

check as such properties now get reified as well.

(JSC::JSObject::deleteProperty):

Call reifyAllStaticProperties() instead of reifyStaticFunctionsForDelete() so that we now reify all properties upon deletion, including the custom accessors. reifyStaticFunctionsForDelete() is now removed and the same reification function is now used by: deletion, getOwnPropertyDescriptor() and eager reification of the prototype objects in the bindings.
Drop code that falls back to calling the static property setter with undefined if we cannot find the property in the property storage. As we now reify ALL properties, the code removing the property from the property storage should succeed, provided that the property actually exists.

(JSC::JSObject::getOwnNonIndexPropertyNames):
Only call getClassPropertyNames() if we have not reified. We should no longer
check the static property table after reifying now that we reify all
properties.

(JSC::JSObject::reifyAllStaticProperties):
Merge with reifyStaticFunctionsForDelete(). The only behavior change is the
flattening to an uncacheable dictionary, like reifyStaticFunctionsForDelete()
used to do.

runtime/JSObject.h:

Source/WebCore:

Attributes on the Window instance should be configurable unless [Unforgeable]:

'constructor' property:
- http://www.w3.org/TR/WebIDL/#interface-prototype-object
Constructor properties (e.g. window.Node):
- http://www.w3.org/TR/WebIDL/#es-interfaces
IDL attributes:
- http://heycam.github.io/webidl/#es-attributes (configurable unless [Unforgeable], e.g. window.location)

Firefox complies with the WebIDL specification but WebKit does not for 1. and 3.

Test: fast/dom/Window/window-properties-configurable.html

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::getOwnPropertySlot):
For known Window properties (i.e. properties in the static property table),
if we have reified and this is same-origin access, then call
Base::getOwnPropertySlot() to get the property from the local property
storage. If we have not reified yet, or this is cross-origin access, query
the static property table. This is to match the behavior of Firefox and
Chrome which seem to keep returning the original properties upon cross
origin access, even if those were deleted or redefined.

(WebCore::JSDOMWindow::put):
The previous code used to call the static property setter for properties in
the static table. However, this does not do the right thing if properties
were reified. For example, deleting window.name and then trying to set it
again would not work. Therefore, update this code to only do this if the
properties have not been reified, similarly to what is done in
JSObject::putInlineSlow().

bindings/scripts/CodeGeneratorJS.pm:

(ConstructorShouldBeOnInstance):
Add a FIXME comment indicating that window.constructor should be on
the prototype as per the Web IDL specification.

(GenerateAttributesHashTable):

Mark 'constructor' property as configurable for Window, as per the specification and consistently with other 'constructor' properties: http://www.w3.org/TR/WebIDL/#interface-prototype-object
Mark properties as configurable even though they are on the instance. Window has its properties on the instance as per the specification:
1. http://heycam.github.io/webidl/#es-attributes
2. http://heycam.github.io/webidl/#PrimaryGlobal (window is [PrimaryGlobal] However, these properties should be configurable as long as they are not marked as [Unforgeable], as per 1.

bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
bindings/scripts/test/JS/JSTestException.cpp:
bindings/scripts/test/JS/JSTestObj.cpp:

Rebaseline bindings tests.

LayoutTests:

fast/dom/Window/window-properties-configurable-expected.txt: Added.
fast/dom/Window/window-properties-configurable.html: Added.

Add a test to check that Window properties are reported as configurable
unless the [Unforgeable] ones and that deleting them actually works.

fast/dom/global-constructors.html:

Update test so it no longer expects window.Node to be shadowable. As per
the specification, the "Node" property is on the window instance, not its
prototype. Therefore, it should cannot be shadowed and setting it to
something actually overwites the previous value, given that the property
is writable as per:

http://heycam.github.io/webidl/#es-interfaces

I have verified that the new behavior is consistent with Firefox.

http/tests/security/cross-origin-reified-window-property-access-expected.txt: Added.
http/tests/security/cross-origin-reified-window-property-access.html: Added.
http/tests/security/resources/reify-window.html: Added.

Add a test case to cover cross-origin access of Window properties after
reification.

js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt:
js/getOwnPropertyDescriptor-unforgeable-attributes.html:

Drop window.self from the list of unforgeable attributes. This attribute
is not unforgeable in our implementation or in the specification:

https://html.spec.whatwg.org/multipage/browsers.html#the-window-object

js/getOwnPropertyDescriptor-window-attributes-expected.txt:
js/getOwnPropertyDescriptor-window-attributes.html:
Add coverage for window.self which is a regular Window property.
Add coverage for window.Node which is a constructor property
Add coverage for window.constructor. It should really be on the prototype as per the specification but this at least checks that the property is configurable, as per the specification.
Rebaseline the test as more checks are passing now that Window properties are marked as configurable.

11:27 AM Changeset in webkit [196373] by beidson@apple.com

3 edits in trunk/Source/WebCore

Modern IDB: Ref cycle between IDBObjectStore and IDBTransaction.
https://bugs.webkit.org/show_bug.cgi?id=154061

Reviewed by Alex Christensen.

No new tests (Currently untestable).

Modules/indexeddb/client/IDBTransactionImpl.cpp:

(WebCore::IDBClient::IDBTransaction::transitionedToFinishing): Make sure the new state makes sense,

set the new state, and then clear the set of referenced object stores which is no longer needed.

(WebCore::IDBClient::IDBTransaction::abort):
(WebCore::IDBClient::IDBTransaction::commit):

Modules/indexeddb/client/IDBTransactionImpl.h:

11:22 AM Changeset in webkit [196372] by jonlee@apple.com

9 edits in trunk/PerformanceTests

Add a ramp controller
https://bugs.webkit.org/show_bug.cgi?id=154028

Provisionally reviewed by Said Abou-Hallawa.

Enhance the graph to include a complexity-fps graph, in addition
to the time graph.

Animometer/developer.html: Add a ramp option.
Animometer/resources/debug-runner/animometer.css: Update the style.
Animometer/resources/strings.js: Flatten the Strings.text constants.
Animometer/resources/debug-runner/animometer.js:

(ResultsTable.call._addGraphButton): Refactor.
(ResultsTable.call._addTest): Add regression data.
(benchmarkController): Add a form that allows the user to switch between the two forms,
Add a form that allows the user to toggle different data. Hide certain header columns
depending on the selected controller.

Animometer/resources/debug-runner/graph.js: Add the complexity regressions.
Animometer/resources/debug-runner/tests.js: Add headers for the ramp results.
Animometer/resources/runner/animometer.js:

(ResultsTable): If a header is disabled don't include them in _flattenedHeaders.

Animometer/tests/resources/main.js:

(Controller): Allow options to specify the capacity for sample arrays.
(Regression): A piecewise regression that tries to fit a slope and a flat profile.
(_calculateRegression): Options can fix the slope and bias when calculating the minimal
error. Sweep across the samples in time (which could be backward depending on the controller)
and calculate the intersection point.
(RampController): This controller assumes that the target frame rate is below
58 FPS. It runs in two stages. The first stage quickly determines the order of
magnitude of objects needed to stress the system by the setting the complexity
to increasingly difficult tiers. Perform a series of ramps descending from a
high-water mark of complexity. The complexity needed to reach the target frame
length is done by performing a piecewise regression on each ramp, and track a
running average of these values. For the next ramp, make that running average
the center of the ramp. With a minimum complexity of 0, the high-water mark is
twice that average. The score is based on the highest complexity that can
reach 60 fps.

11:22 AM Changeset in webkit [196371] by Ryan Haddad

2 edits in trunk/LayoutTests

Skop fast/regions/text-break-properties.html on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=153762

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

10:20 AM Changeset in webkit [196370] by mitz@apple.com

4 edits in trunk/Source/WebKit2

[Mac] Stop installing the legacy processes
https://bugs.webkit.org/show_bug.cgi?id=154062

Reviewed by Anders Carlsson.

Configurations/All.xcconfig: Removed the legacy processes from EXCLUDED_SOURCE_FILE_NAMES for iOS, now that they are no longer included in a Copy Files build phase.
Configurations/BaseLegacyProcess.xcconfig: Set SKIP_INSTALL to YES for OS X as well.
WebKit2.xcodeproj/project.pbxproj: Removed the Copy Files build phase that copied the processes into the framework in engineering builds. Renamed the “Add current version symlinks” script build phase to “Add XPCServices symlink”, and changed it to do just that.

10:13 AM Changeset in webkit [196369] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r196251.
https://bugs.webkit.org/show_bug.cgi?id=154078

Large regression on Dromaeo needs explanation (Requested by
kling on #webkit).

Reverted changeset:

"Visiting a WeakBlock should report bytes visited, since we
reported them allocated."
https://bugs.webkit.org/show_bug.cgi?id=153978
http://trac.webkit.org/changeset/196251

9:50 AM Changeset in webkit [196368] by Csaba Osztrogonác

5 edits in trunk/Source/JavaScriptCore

REGRESSION(r196331): It made ~180 JSC tests crash on ARMv7 Linux
https://bugs.webkit.org/show_bug.cgi?id=154064

Reviewed by Mark Lam.

bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::generate): Added EABI_32BIT_DUMMY_ARG where it is necessary.

dfg/DFGSpeculativeJIT.h: Fixed the comment.
jit/CCallHelpers.h:

(JSC::CCallHelpers::setupArgumentsWithExecState): Added.

wasm/WASMFunctionCompiler.h: Fixed the comment.

9:23 AM Changeset in webkit [196367] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

REGRESSION(r195770): Use-after-free in ResourceLoaderOptions::cachingPolicy
https://bugs.webkit.org/show_bug.cgi?id=153727
<rdar://problem/24429886>

Reviewed by Darin Adler.

Follow-up after r195965. Only protect those parts of CachedResource::removeClient() which
affect the MemoryCache when allowsCaching() is false.

loader/cache/CachedResource.cpp:

(WebCore::CachedResource::removeClient):

8:53 AM Changeset in webkit [196366] by bshafiei@apple.com

6 edits
2 copies in branches/safari-601-branch/Source/JavaScriptCore

Merged r196179. rdar://problem/24574519

2:28 AM Changeset in webkit [196365] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

Fix the !(ENABLE(SHADOW_DOM)

ENABLE(DETAILS_ELEMENT)) after r196281

https://bugs.webkit.org/show_bug.cgi?id=154035

Reviewed by Antti Koivisto.

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::Context::Context):

Feb 9, 2016:

10:58 PM Changeset in webkit [196364] by Carlos Garcia Campos

2 edits in trunk/Source/WebCore

[GTK] Toggle buttons are blurry with GTK+ 3.19
https://bugs.webkit.org/show_bug.cgi?id=154007

Reviewed by Michael Catanzaro.

Use min-width/min-height style properties when GTK+ >= 3.19.7 to
get the size of toggle buttons.

rendering/RenderThemeGtk.cpp:

(WebCore::setToggleSize):
(WebCore::paintToggle):

10:53 PM Changeset in webkit [196363] by Carlos Garcia Campos

2 edits in trunk/Source/WebKit2

REGRESSION(r196183): [GTK] Broke TestInspector
https://bugs.webkit.org/show_bug.cgi?id=153945

Reviewed by Michael Catanzaro.

When the inspector view is detached and not added to a window,
which happens when it's closed, the inspector view is destroyed
because it doesn't have a parent anymore. When the inspector view
is destroyed we notify the web process that the inspector was
closed. Before r196183 this was not a problem, because the call to
WebInspectorProxy::didClose() from platformDetach() returned early
because WebInspectorProxy::didClose() had already set
m_inspectorPage to nullptr. In r196183 m_inspectorPage is set to
nullptr after platformDetach(), so we end up trying to detach the
inpector view again. To prevent this cycle, we should disconnect
the destroyed signal handler from the inspector view when
platformDetach() is called from WebInspectorProxy::didClose().

UIProcess/gtk/WebInspectorProxyGtk.cpp:

(WebKit::WebInspectorProxy::platformDetach):

10:02 PM Changeset in webkit [196362] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Regression: Web Inspector: Sometimes in Elements panel two elements showed as selected at the same time
https://bugs.webkit.org/show_bug.cgi?id=149742
<rdar://problem/24492481>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-09
Reviewed by Timothy Hatcher.

UserInterface/Views/DOMTreeElement.js:

(WebInspector.DOMTreeElement.prototype.moveChild):
Since removing and re-adding this tree element may forgot its
entire child tree, re-select the selected child that may have
just been lost in the shuffle.

UserInterface/Views/TreeOutline.js:

(WebInspector.TreeOutline.prototype._forgetTreeElement):
When forgetting the selected tree element, also deselect the
forgotten tree element so it clears its selected state.

10:01 PM Changeset in webkit [196361] by keith_miller@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

calling methods off super in a class constructor should check for TDZ
https://bugs.webkit.org/show_bug.cgi?id=154060

Reviewed by Ryosuke Niwa.

In a class constructor we need to check for TDZ when calling a method
off the super class. This is because, for super method calls, we use
the derived class's newly constructed object as the super method's
this value.

bytecompiler/NodesCodegen.cpp:

(JSC::FunctionCallDotNode::emitBytecode):

tests/stress/super-method-calls-check-tdz.js: Added.

(Base):
(Derived):
(test):

9:36 PM Changeset in webkit [196360] by aakash_jain@apple.com

8 edits in trunk/Source/WebCore

Headers that use WEBCORE_EXPORT should include PlatformExportMacros.h
https://bugs.webkit.org/show_bug.cgi?id=146984

Reviewed by Alexey Proskuryakov.

Modules/speech/SpeechSynthesis.h:
contentextensions/ContentExtensionError.h:
dom/DeviceOrientationClient.h:
platform/graphics/Color.h:
platform/ios/wak/WebCoreThread.h:
platform/network/CacheValidation.h:
platform/network/cf/CertificateInfo.h:

8:52 PM Changeset in webkit [196359] by bshafiei@apple.com

6 edits
2 copies in branches/safari-601.1.46-branch/Source/JavaScriptCore

Merged r196179. rdar://problem/24574469

7:12 PM Changeset in webkit [196358] by bshafiei@apple.com

4 edits in branches/safari-601-branch/Source/WebCore

Merged r190616. rdar://problem/24563410

7:11 PM Changeset in webkit [196357] by bshafiei@apple.com

2 edits in branches/safari-601-branch/Source/WebCore

Merge patch for rdar://problem/24563410.

7:04 PM Changeset in webkit [196356] by bshafiei@apple.com

1 copy in tags/Safari-601.3.9.1.4

New tag.

7:03 PM Changeset in webkit [196355] by bshafiei@apple.com

4 edits in branches/safari-601.3.9.1-branch/Source/WebCore

Merged r190616. rdar://problem/24563410

7:00 PM Changeset in webkit [196354] by bshafiei@apple.com

2 edits in branches/safari-601.3.9.1-branch/Source/WebCore

Merge patch for rdar://problem/24563410.

6:55 PM Changeset in webkit [196353] by bshafiei@apple.com

5 edits in branches/safari-601.3.9.1-branch/Source

Versioning.

6:33 PM Changeset in webkit [196352] by n_wang@apple.com

19 edits
2 adds in trunk

AX: Implement word related text marker functions using TextIterator
https://bugs.webkit.org/show_bug.cgi?id=153939
<rdar://problem/24269605>

Reviewed by Chris Fleizach.

Source/WebCore:

Using CharacterOffset to implement word related text marker calls. Reused
logic from previousBoundary and nextBoundary in VisibleUnits class.

Test: accessibility/mac/text-marker-word-nav.html

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::traverseToOffsetInRange):
(WebCore::AXObjectCache::rangeForNodeContents):
(WebCore::isReplacedNodeOrBR):
(WebCore::characterOffsetsInOrder):
(WebCore::resetNodeAndOffsetForReplacedNode):
(WebCore::setRangeStartOrEndWithCharacterOffset):
(WebCore::AXObjectCache::rangeForUnorderedCharacterOffsets):
(WebCore::AXObjectCache::setTextMarkerDataWithCharacterOffset):
(WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
(WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
(WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
(WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
(WebCore::AXObjectCache::previousNode):
(WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
(WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
(WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
(WebCore::AXObjectCache::nextCharacterOffset):
(WebCore::AXObjectCache::previousCharacterOffset):
(WebCore::startWordBoundary):
(WebCore::endWordBoundary):
(WebCore::AXObjectCache::startCharacterOffsetOfWord):
(WebCore::AXObjectCache::endCharacterOffsetOfWord):
(WebCore::AXObjectCache::previousWordStartCharacterOffset):
(WebCore::AXObjectCache::nextWordEndCharacterOffset):
(WebCore::AXObjectCache::leftWordRange):
(WebCore::AXObjectCache::rightWordRange):
(WebCore::characterForCharacterOffset):
(WebCore::AXObjectCache::characterAfter):
(WebCore::AXObjectCache::characterBefore):
(WebCore::parentEditingBoundary):
(WebCore::AXObjectCache::nextWordBoundary):
(WebCore::AXObjectCache::previousWordBoundary):
(WebCore::AXObjectCache::rootAXEditableElement):

accessibility/AXObjectCache.h:

(WebCore::AXObjectCache::removeNodeForUse):
(WebCore::AXObjectCache::isNodeInUse):

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper previousTextMarkerForNode:offset:]):
(-[WebAccessibilityObjectWrapper textMarkerForNode:offset:ignoreStart:]):
(-[WebAccessibilityObjectWrapper textMarkerForNode:offset:]):
(textMarkerForCharacterOffset):
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

editing/VisibleUnits.cpp:

(WebCore::rightWordPosition):
(WebCore::prepend):
(WebCore::appendRepeatedCharacter):
(WebCore::suffixLengthForRange):
(WebCore::prefixLengthForRange):
(WebCore::backwardSearchForBoundaryWithTextIterator):
(WebCore::forwardSearchForBoundaryWithTextIterator):
(WebCore::previousBoundary):
(WebCore::nextBoundary):

editing/VisibleUnits.h:

Tools:

DumpRenderTree/AccessibilityUIElement.cpp:

(endTextMarkerCallback):
(leftWordTextMarkerRangeForTextMarkerCallback):
(rightWordTextMarkerRangeForTextMarkerCallback):
(previousWordStartTextMarkerForTextMarkerCallback):
(nextWordEndTextMarkerForTextMarkerCallback):
(setSelectedVisibleTextRangeCallback):
(AccessibilityUIElement::setSelectedVisibleTextRange):
(AccessibilityUIElement::leftWordTextMarkerRangeForTextMarker):
(AccessibilityUIElement::rightWordTextMarkerRangeForTextMarker):
(AccessibilityUIElement::previousWordStartTextMarkerForTextMarker):
(AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):
(AccessibilityUIElement::getJSClass):

DumpRenderTree/AccessibilityUIElement.h:
DumpRenderTree/ios/AccessibilityUIElementIOS.mm:

(AccessibilityUIElement::setSelectedVisibleTextRange):
(AccessibilityUIElement::leftWordTextMarkerRangeForTextMarker):
(AccessibilityUIElement::rightWordTextMarkerRangeForTextMarker):
(AccessibilityUIElement::previousWordStartTextMarkerForTextMarker):
(AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):

DumpRenderTree/mac/AccessibilityUIElementMac.mm:

WebKitTestRunner/InjectedBundle/AccessibilityUIElement.cpp:

(WTR::AccessibilityUIElement::setBoolAttributeValue):
(WTR::AccessibilityUIElement::leftWordTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::rightWordTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::previousWordStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):

WebKitTestRunner/InjectedBundle/AccessibilityUIElement.h:
WebKitTestRunner/InjectedBundle/Bindings/AccessibilityUIElement.idl:
WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:

(WTR::AccessibilityUIElement::endTextMarker):
(WTR::AccessibilityUIElement::leftWordTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::rightWordTextMarkerRangeForTextMarker):
(WTR::AccessibilityUIElement::previousWordStartTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::nextWordEndTextMarkerForTextMarker):
(WTR::AccessibilityUIElement::mathPostscriptsDescription):

WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:

LayoutTests:

accessibility/mac/text-marker-word-nav-expected.txt: Added.
accessibility/mac/text-marker-word-nav.html: Added.
accessibility/text-marker/text-marker-previous-next-expected.txt:
accessibility/text-marker/text-marker-previous-next.html:

6:29 PM Changeset in webkit [196351] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.6/Source/WebCore

Merged r195816. rdar://problem/24580198

5:21 PM Changeset in webkit [196350] by dbates@webkit.org

5 edits
11 adds in trunk/Source/WebCore

CSP: Extract helper classes into their own files
https://bugs.webkit.org/show_bug.cgi?id=154040
<rdar://problem/24571189>

Reviewed by Brent Fulgham.

No functionality was changed. So, no new tests.

CMakeLists.txt: Add files ContentSecurityPolicy{DirectiveList, MediaListDirective, Source, SourceList, SourceListDirective}.cpp.
WebCore.xcodeproj/project.pbxproj: Ditto.
page/csp/ContentSecurityPolicy.cpp: Clean up #includes. Include header ParsingUtilities.h so that we can remove our own

variants of skip{Exactly, Until, While}(). Update code as necessary for class renames.
(WebCore::skipExactly): Deleted; instead use the analogous function in ParsingUtilities.h.
(WebCore::skipUntil): Deleted; instead use the analogous function in ParsingUtilities.h.
(WebCore::skipWhile): Deleted; instead use the analogous function in ParsingUtilities.h.
(WebCore::isSourceListNone): Moved to file ContentSecurityPolicySourceList.cpp.
(WebCore::CSPSource): Deleted; moved implementation to files ContentSecurityPolicySource.{cpp, h}.
(WebCore::CSPSourceList): Deleted; moved implementation to files ContentSecurityPolicySourceList.{cpp, h}.
(WebCore::CSPDirective): Deleted; moved implementation to file ContentSecurityPolicyDirective.h.
(WebCore::MediaListDirective): Deleted; moved implementation to files ContentSecurityPolicyMediaListDirective.{cpp, h}.
(WebCore::SourceListDirective): Deleted; moved implementation to files ContentSecurityPolicySourceListDirective.{cpp, h}.
(WebCore::CSPDirectiveList): Deleted; moved implementation to files ContentSecurityPolicyDirectiveList.{cpp, h}.

page/csp/ContentSecurityPolicy.h:
page/csp/ContentSecurityPolicyDirective.h: Added.
page/csp/ContentSecurityPolicyDirectiveList.cpp: Added; removed use of ternary operator where it made the code less readable.

Updated code to make use of the functions defined in ParsingUtilities.h.
(WebCore::isExperimentalDirectiveName): Moved from file ContentSecurityPolicy.cpp.
(WebCore::isCSPDirectiveName): Ditto.
(WebCore::isDirectiveNameCharacter): Ditto.
(WebCore::isDirectiveValueCharacter): Ditto.
(WebCore::isNotASCIISpace): Ditto.

page/csp/ContentSecurityPolicyDirectiveList.h: Added.
page/csp/ContentSecurityPolicyMediaListDirective.cpp: Added. Updated code to make use of the functions defined in ParsingUtilities.h.

(WebCore::isMediaTypeCharacter): Moved from file ContentSecurityPolicy.cpp.
(WebCore::isNotASCIISpace): Ditto.

page/csp/ContentSecurityPolicyMediaListDirective.h: Added.
page/csp/ContentSecurityPolicySource.cpp: Added.
page/csp/ContentSecurityPolicySource.h: Added.
page/csp/ContentSecurityPolicySourceList.cpp: Added. Updated code to make use of the functions defined in ParsingUtilities.h.

(WebCore::isSourceCharacter): Moved from file ContentSecurityPolicy.cpp.
(WebCore::isHostCharacter): Ditto.
(WebCore::isPathComponentCharacter): Ditto.
(WebCore::isSchemeContinuationCharacter): Ditto.
(WebCore::isNotColonOrSlash): Ditto.
(WebCore::isSourceListNone): Ditto.

page/csp/ContentSecurityPolicySourceList.h: Added.
page/csp/ContentSecurityPolicySourceListDirective.cpp: Added.
page/csp/ContentSecurityPolicySourceListDirective.h: Added.

5:15 PM Changeset in webkit [196349] by beidson@apple.com

3 edits in trunk/Source/WebCore

Modern IDB: TransactionOperation objects leak.
https://bugs.webkit.org/show_bug.cgi?id=154054

Reviewed by Alex Christensen.

No new tests (Currently untestable).

Modules/indexeddb/client/IDBTransactionImpl.cpp:

(WebCore::IDBClient::IDBTransaction::abortOnServerAndCancelRequests): Remove the TransactionOperation from

the map, as this operation doesn't complete "normally" like most others.

(WebCore::IDBClient::IDBTransaction::commitOnServer): Ditto.

Modules/indexeddb/client/TransactionOperation.h:

(WebCore::IDBClient::TransactionOperation::perform): Clear the m_performFunction after use,

as it holds a lambda that holds a RefPtr to the IDBTransaction, as well as a self-ref.

(WebCore::IDBClient::TransactionOperation::completed): Clear m_completeFunction for the same reasons.

5:13 PM Changeset in webkit [196348] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Allow copying all headers in the request/response header tables
https://bugs.webkit.org/show_bug.cgi?id=154048
<rdar://problem/24576302>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-09
Reviewed by Timothy Hatcher.

Localizations/en.lproj/localizedStrings.js:

New "Copy Table" string.

UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid):
(WebInspector.DataGrid.prototype._contextMenuInHeader):
Add context menu support for table header cells, and give them a
"Copy Table" context menu if there is copyable data.

(WebInspector.DataGrid.prototype._contextMenuInDataTable):
Add "Copy Table" context menu for copyable rows.

(WebInspector.DataGrid.prototype._copyTextForDataGridNode):
(WebInspector.DataGrid.prototype._copyTextForDataGridHeaders):
(WebInspector.DataGrid.prototype._copyTable):
(WebInspector.DataGrid.prototype._hasCopyableData):
Helpers for determining copyability and copying tab separated data.

5:08 PM Changeset in webkit [196347] by commit-queue@webkit.org

8 edits in trunk/Source/WebKit2

Unreviewed, rolling out r196341.
https://bugs.webkit.org/show_bug.cgi?id=154056

This change broke existing API tests on Mac and iOS (Requested
by ryanhaddad on #webkit).

Reverted changeset:

"Add SPI to remove individual user scripts or user style
sheets"
https://bugs.webkit.org/show_bug.cgi?id=154046
http://trac.webkit.org/changeset/196341

4:27 PM Changeset in webkit [196346] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark perf/adding-radio-buttons.html as flaky on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=154055

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

4:15 PM Changeset in webkit [196345] by jer.noble@apple.com

3 edits in trunk/Source/WebCore

[Mac] Graphical corruption in videos when enabling custom loading path
https://bugs.webkit.org/show_bug.cgi?id=154044

Reviewed by Alex Christensen.

The NSOperationQueue provided by AVFoundation from the AVAssetResourceLoader queue is not
set to be a serial queue. So when adding dataReceived operations to that queue, there exists
the possibility that some operations are handled before others, and the client will receieve
data out of order.

A real NSURLSession object will only issue another operation when the first operation
completes, so emulate this behavior in WebCoreNSURLSession by using a serial dispatch queue.
The internal queue will enqueue an operation to the resource loader's queue, and block until
that operation completes, thus ensuring ordering of the data (and other) operations.

platform/network/cocoa/WebCoreNSURLSession.h:
platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]): Initialize _internalQueue
(-[WebCoreNSURLSession addDelegateOperation:]): Added utility method.
(-[WebCoreNSURLSession taskCompleted:]): Call -addDelegateOperation:
(-[WebCoreNSURLSession finishTasksAndInvalidate]): Ditto.
(-[WebCoreNSURLSession resetWithCompletionHandler:]): Ditto.
(-[WebCoreNSURLSession flushWithCompletionHandler:]): Ditto.
(-[WebCoreNSURLSession getTasksWithCompletionHandler:]): Ditto.
(-[WebCoreNSURLSession getAllTasksWithCompletionHandler:]): Ditto.
(-[WebCoreNSURLSessionDataTask resource:receivedResponse:]): Ditto.
(-[WebCoreNSURLSessionDataTask resource:receivedData:length:]): Ditto.
(-[WebCoreNSURLSessionDataTask resourceFinished:]): Ditto.

Drive-by fix:
(-[WebCoreNSURLSessionDataTask resource:receivedData:length:]): Set countOfBytesReceived outside the operation,

queue, matching NSURLSessionDataTask's behavior.

4:14 PM Changeset in webkit [196344] by Ryan Haddad

4 edits
2 adds in trunk/LayoutTests

Rebaseline tests for ios-simulator after r196222
https://bugs.webkit.org/show_bug.cgi?id=154053

Reviewed by Zalan Bujtas.

platform/ios-simulator-wk2/compositing/geometry/composited-in-columns-expected.txt:
platform/ios-simulator-wk2/compositing/layer-creation/overlap-animation-container-expected.txt: Added.
platform/ios-simulator-wk2/compositing/visibility/visibility-image-layers-dynamic-expected.txt:
platform/ios-simulator-wk2/fast/inline/continuation-outlines-with-layers-expected.txt: Added.
platform/ios-simulator-wk2/fast/layers/scroll-rect-to-visible-expected.txt:

4:02 PM Changeset in webkit [196343] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline compositing/overflow/scrollbar-painting.html for ios-simulator after r196244

Unreviewed test gardening.

platform/ios-simulator-wk2/compositing/overflow/scrollbar-painting-expected.txt:

3:42 PM Changeset in webkit [196342] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: localStorage inspector very slow on big values
https://bugs.webkit.org/show_bug.cgi?id=123750
<rdar://problem/15384930>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-09
Reviewed by Timothy Hatcher.

It is not useful to show very large strings in the DOM Storage DataGrid.
This change truncates display strings to roughly 200 characters. If the
developer really wants the full value of the string they can just access
it through localStorage.

UserInterface/Models/DOMStorageObject.js:

(WebInspector.DOMStorageObject.prototype.getEntries.innerCallback):
(WebInspector.DOMStorageObject.prototype.getEntries):
(WebInspector.DOMStorageObject.prototype.itemUpdated):
Modernize.

UserInterface/Views/DOMStorageContentView.js:

(WebInspector.DOMStorageContentView):
(WebInspector.DOMStorageContentView.prototype.itemRemoved):
Modernize.

(WebInspector.DOMStorageContentView.prototype.itemAdded):
(WebInspector.DOMStorageContentView.prototype.itemUpdated):
(WebInspector.DOMStorageContentView.prototype._truncateValue):
(WebInspector.DOMStorageContentView.prototype._populate):
Whenever we get a value that we will display, truncate it to
just 200 characters.

3:04 PM Changeset in webkit [196341] by andersca@apple.com

8 edits in trunk/Source/WebKit2

Add SPI to remove individual user scripts or user style sheets
https://bugs.webkit.org/show_bug.cgi?id=154046
rdar://problem/23596352

Reviewed by Sam Weinig.

UIProcess/API/Cocoa/WKUserContentController.mm:

(-[WKUserContentController _removeUserScript:]):
(-[WKUserContentController _userStyleSheets]):
(-[WKUserContentController _addUserStyleSheet:]):
(-[WKUserContentController _removeUserStyleSheet:]):

UIProcess/API/Cocoa/WKUserContentControllerPrivate.h:
UIProcess/UserContent/WebUserContentControllerProxy.cpp:

UIProcess/UserContent/WebUserContentControllerProxy.h:

(WebKit::WebUserContentControllerProxy::userStyleSheets):

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::removeUserScript):
(WebKit::WebUserContentController::removeUserStyleSheet):

WebProcess/UserContent/WebUserContentController.h:
WebProcess/UserContent/WebUserContentController.messages.in:

3:00 PM Changeset in webkit [196340] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html for ios-simulator after r196303

Unreviewed test gardening.

platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:

2:58 PM Changeset in webkit [196339] by n_wang@apple.com

2 edits in trunk/Source/WebCore

[iOS Simulator] accessibility/text-marker/text-marker-range-stale-node-crash.html crashing
https://bugs.webkit.org/show_bug.cgi?id=154039

Reviewed by Chris Fleizach.

We are accessing the derefed node in the CharacterOffset object, we should create an empty
CharacterOffset object if the node is not in use.

It's covered by the test accessibility/text-marker/text-marker-range-stale-node-crash.html.

accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityTextMarker characterOffset]):
(-[WebAccessibilityTextMarker isIgnored]):

2:54 PM Changeset in webkit [196338] by Ryan Haddad

24 edits in trunk/LayoutTests

Rebaseline more tests for ios-simulator after r196244

Unreviewed test gardening.

platform/ios-simulator-wk2/compositing/overflow/overflow-scroll-expected.txt:
platform/ios-simulator-wk2/css2.1/20110323/abspos-non-replaced-width-margin-000-expected.txt:
platform/ios-simulator-wk2/css2.1/20110323/abspos-replaced-width-margin-000-expected.txt:
platform/ios-simulator-wk2/fast/block/float/overhanging-tall-block-expected.txt:
platform/ios-simulator-wk2/fast/clip/014-expected.txt:
platform/ios-simulator-wk2/fast/multicol/overflow-unsplittable-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/BottomToTop-bt-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/BottomToTop-lr-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/BottomToTop-rl-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/BottomToTop-tb-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/RightToLeft-bt-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/RightToLeft-lr-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/RightToLeft-rl-dynamic-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/RightToLeft-rl-expected.txt:
platform/ios-simulator-wk2/fast/multicol/pagination/RightToLeft-tb-expected.txt:
platform/ios-simulator-wk2/fast/multicol/vertical-rl/column-break-with-balancing-expected.txt:
platform/ios-simulator-wk2/fast/multicol/vertical-rl/column-rules-expected.txt:
platform/ios-simulator-wk2/fast/multicol/vertical-rl/float-paginate-complex-expected.txt:
platform/ios-simulator-wk2/fast/overflow/float-in-relpositioned-expected.txt:
platform/ios-simulator-wk2/fast/overflow/overflow-auto-position-absolute-expected.txt:
platform/ios-simulator-wk2/fast/overflow/paged-x-div-expected.txt:
platform/ios-simulator-wk2/fast/overflow/paged-x-div-with-column-gap-expected.txt:
platform/ios-simulator-wk2/fast/overflow/scroll-nested-positioned-layer-in-overflow-expected.txt:

2:42 PM Changeset in webkit [196337] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Don't crash if we fail to parse a builtin
https://bugs.webkit.org/show_bug.cgi?id=154047
rdar://problem/24300617

Reviewed by Mark Lam.

Crashing probably seemed like a good idea at the time, but we could get here in case of a
near stack overflow, so that the parser bails because of recursion.

parser/Parser.h:

(JSC::parse):

2:16 PM Changeset in webkit [196336] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Expiration column in Storage tab can't be sorted
https://bugs.webkit.org/show_bug.cgi?id=154043
<rdar://problem/24572272>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-09
Reviewed by Brian Burg.

UserInterface/Views/CookieStorageContentView.js:

(WebInspector.CookieStorageContentView.prototype._sortDataGrid.expiresCompare):
Sort Session as the shortest time, not the longest time. Use the
cookie.expires date when sorting, not the locale string.

2:09 PM Changeset in webkit [196335] by mmaxfield@apple.com

2 edits in trunk/Source/WebCore

Unreviewed build fix after r196322

Unreviewed.

css/CSSFontFace.cpp:

(WebCore::CSSFontFace::font):

2:01 PM Changeset in webkit [196334] by Alan Bujtas

3 edits
2 adds in trunk

Outline corners do not align properly for multiline inlines.
https://bugs.webkit.org/show_bug.cgi?id=154025

Reviewed by David Hyatt.

Adjust border position when outline-offset > 0. This patch also
removes integral pixelsnapping (drawLineForBoxSide takes care of
device pixelsnapping).

Source/WebCore:

Test: fast/inline/outline-corners-with-offset.html

rendering/RenderInline.cpp:

(WebCore::RenderInline::paintOutlineForLine):

LayoutTests:

fast/inline/outline-corners-with-offset-expected.html: Added.
fast/inline/outline-corners-with-offset.html: Added.

1:49 PM Changeset in webkit [196333] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

Analysis task page on v3 show progression as regressions
https://bugs.webkit.org/show_bug.cgi?id=154045

Reviewed by Chris Dumez.

The bug was caused by TestGroup.compareTestResults referring to undefined _smallerIsBetter.
Retrieve it from the associated metric object via the owner analysis task.

public/v3/models/test-group.js:

1:30 PM Changeset in webkit [196332] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

[Mac] Adopt NSURLSession properties in AVAssetResourceLoader

Rubber-stamped by Eric Carlson;

Set the correct global variable from setAVFoundationNSURLSessionEnabled().

page/Settings.cpp:

(WebCore::Settings::setAVFoundationNSURLSessionEnabled):

1:19 PM Changeset in webkit [196331] by barraclough@apple.com

60 edits in trunk/Source

GetValueFunc/PutValueFunc should not take both slotBase and thisValue
https://bugs.webkit.org/show_bug.cgi?id=154009

Reviewed by Geoff Garen.

In JavaScript there are two types of properties - regular value properties, and accessor properties.
One difference between these is how they are reflected by getOwnPropertyDescriptor, and another is
what object they operate on in the case of a prototype access. If you access a value property of a
prototype object it return a value pertinent to the prototype, but in the case of a prototype object
returning an accessor, then the accessor function is applied to the base object of the access.

JSC supports special 'custom' properties implemented as a c++ callback, and these custom properties
can be used to implement either value- or accessor-like behavior. getOwnPropertyDescriptor behavior
is selected via the CustomAccessor attribute. Value- or accessor-like object selection is current
supported by passing both the slotBase and the thisValue to the callback,and hoping it uses the
right one. This is probably inefficient, bug-prone, and leads to crazy like JSBoundSlotBaseFunction.

Instead, just pass one thisValue to the callback functions, consistent with CustomAccessor.

Source/JavaScriptCore:

API/JSCallbackObject.h:
API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject<Parent>::getStaticValue):
(JSC::JSCallbackObject<Parent>::staticFunctionGetter):
(JSC::JSCallbackObject<Parent>::callbackGetter):

Merged slotBase & thisValue to custom property callbacks.

bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::generate):

Modified the call being JIT generated - GetValueFunc/PutValueFunc now only take 3, rather than 4 arguments. Selects which one to keep/drop based on access type.

(WTF::printInternal):

bytecode/PolymorphicAccess.h:

(JSC::AccessCase::isGet):
(JSC::AccessCase::isPut):
(JSC::AccessCase::isIn):
(JSC::AccessCase::doesCalls):
(JSC::AccessCase::isGetter):

bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::computeForStubInfo):

jit/Repatch.cpp:

(JSC::tryCacheGetByID):
(JSC::tryCachePutByID):

Split the CustomGetter/Setter access types into Value/Accessor variants.

jsc.cpp:

(WTF::CustomGetter::getOwnPropertySlot):
(WTF::CustomGetter::customGetter):
(WTF::RuntimeArray::RuntimeArray):
(WTF::RuntimeArray::lengthGetter):

Merged slotBase & thisValue to custom property callbacks.

runtime/CustomGetterSetter.cpp:

(JSC::callCustomSetter):

Pass 3 arguments when calling PutValueFunc.

runtime/CustomGetterSetter.h:
runtime/JSBoundSlotBaseFunction.cpp:

(JSC::boundSlotBaseFunctionCall):
(JSC::JSBoundSlotBaseFunction::JSBoundSlotBaseFunction):

runtime/JSCJSValue.cpp:

(JSC::JSValue::putToPrimitive):

callCustomSetter currently takes a flag to distinguish value/accessor calls.

runtime/JSFunction.cpp:

(JSC::retrieveArguments):
(JSC::JSFunction::argumentsGetter):
(JSC::retrieveCallerFunction):
(JSC::JSFunction::callerGetter):
(JSC::JSFunction::lengthGetter):
(JSC::JSFunction::nameGetter):

runtime/JSFunction.h:
runtime/JSModuleNamespaceObject.cpp:

(JSC::JSModuleNamespaceObject::visitChildren):
(JSC::callbackGetter):

Merged slotBase & thisValue to custom property callbacks.

runtime/JSObject.cpp:

(JSC::JSObject::putInlineSlow):

callCustomSetter currently takes a flag to distinguish value/accessor calls.

runtime/Lookup.h:

(JSC::putEntry):

split PutPropertySlot setCustom into Value/Accessor variants.

runtime/PropertySlot.cpp:

(JSC::PropertySlot::functionGetter):
(JSC::PropertySlot::customGetter):

runtime/PropertySlot.h:

(JSC::PropertySlot::PropertySlot):
(JSC::PropertySlot::getValue):

added customGetter helper to call GetValueFunc.

runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::PutPropertySlot):
(JSC::PutPropertySlot::setNewProperty):
(JSC::PutPropertySlot::setCustomValue):
(JSC::PutPropertySlot::setCustomAccessor):
(JSC::PutPropertySlot::setThisValue):
(JSC::PutPropertySlot::customSetter):
(JSC::PutPropertySlot::context):
(JSC::PutPropertySlot::isStrictMode):
(JSC::PutPropertySlot::isCacheablePut):
(JSC::PutPropertySlot::isCacheableSetter):
(JSC::PutPropertySlot::isCacheableCustom):
(JSC::PutPropertySlot::isCustomAccessor):
(JSC::PutPropertySlot::isInitialization):
(JSC::PutPropertySlot::cachedOffset):
(JSC::PutPropertySlot::setCustomProperty): Deleted.

split PutPropertySlot setCustom into Value/Accessor variants.

runtime/RegExpConstructor.cpp:

(JSC::RegExpConstructor::getOwnPropertySlot):
(JSC::regExpConstructorDollar1):
(JSC::regExpConstructorDollar2):
(JSC::regExpConstructorDollar3):
(JSC::regExpConstructorDollar4):
(JSC::regExpConstructorDollar5):
(JSC::regExpConstructorDollar6):
(JSC::regExpConstructorDollar7):
(JSC::regExpConstructorDollar8):
(JSC::regExpConstructorDollar9):
(JSC::regExpConstructorInput):
(JSC::regExpConstructorMultiline):
(JSC::regExpConstructorLastMatch):
(JSC::regExpConstructorLastParen):
(JSC::regExpConstructorLeftContext):
(JSC::regExpConstructorRightContext):
(JSC::setRegExpConstructorInput):
(JSC::setRegExpConstructorMultiline):

runtime/RegExpObject.cpp:

(JSC::RegExpObject::defineOwnProperty):
(JSC::regExpObjectSetLastIndexStrict):
(JSC::regExpObjectSetLastIndexNonStrict):
(JSC::RegExpObject::put):

Merged slotBase & thisValue to custom property callbacks.

Source/WebCore:

bindings/js/JSDOMBinding.cpp:

(WebCore::printErrorMessageForFrame):
(WebCore::objectToStringFunctionGetter):

bindings/js/JSDOMBinding.h:

(WebCore::propertyNameToString):
(WebCore::getStaticValueSlotEntryWithoutCaching<JSDOMObject>):
(WebCore::nonCachingStaticFunctionGetter):

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::visitAdditionalChildren):
(WebCore::childFrameGetter):
(WebCore::namedItemGetter):
(WebCore::jsDOMWindowWebKit):
(WebCore::jsDOMWindowIndexedDB):

add missing null check, in case indexDB acessor is applied to non-window object.

bindings/js/JSPluginElementFunctions.cpp:

(WebCore::pluginScriptObject):
(WebCore::pluginElementPropertyGetter):

bindings/js/JSPluginElementFunctions.h:
bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateImplementation):

bridge/runtime_array.cpp:

(JSC::RuntimeArray::destroy):
(JSC::RuntimeArray::lengthGetter):

bridge/runtime_array.h:
bridge/runtime_method.cpp:

(JSC::RuntimeMethod::finishCreation):
(JSC::RuntimeMethod::lengthGetter):

bridge/runtime_method.h:
bridge/runtime_object.cpp:

(JSC::Bindings::RuntimeObject::invalidate):
(JSC::Bindings::RuntimeObject::fallbackObjectGetter):
(JSC::Bindings::RuntimeObject::fieldGetter):
(JSC::Bindings::RuntimeObject::methodGetter):

bridge/runtime_object.h:
- Merged slotBase & thisValue to custom property callbacks.

Source/WebKit2:

WebProcess/Plugins/Netscape/JSNPObject.cpp:

(WebKit::JSNPObject::getOwnPropertyNames):
(WebKit::JSNPObject::propertyGetter):
(WebKit::JSNPObject::methodGetter):

WebProcess/Plugins/Netscape/JSNPObject.h:
- Merged slotBase & thisValue to custom property callbacks.

1:17 PM Changeset in webkit [196330] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

Build-fix; add Nullibility macros around previously un-macro'd class definitions.

platform/spi/mac/AVFoundationSPI.h:

1:03 PM Changeset in webkit [196329] by jer.noble@apple.com

2 edits in trunk/Source/WebKit2

[Mac] Exiting fullscreen through the placeholder action leaves window in empty state
https://bugs.webkit.org/show_bug.cgi?id=152979
<rdar://problem/24132309>

Reviewed by Brent Fulgham.

In r194593, we relaxed the _fullScreenState requirement in -finishedExitFullScreenAnimation: to handle
the case where the request to exit fullscreen came from outside the process. However, in so doing, we
allowed -finishedExitFullScreenAnimation: to be called twice, and in so doing, leave the original window
empty of its WebView. Tighten up the restriction of _fullScreenState to allow only the "InFullScreen"
state (to take care of the external exit command) and the "ExitingFullScreen" state, to handle the
normal teardown path.

UIProcess/mac/WKFullScreenWindowController.mm:

(-[WKFullScreenWindowController finishedExitFullScreenAnimation:]):

12:56 PM Changeset in webkit [196328] by jer.noble@apple.com

15 edits in trunk/Source

[Mac] Adopt NSURLSession properties in AVAssetResourceLoader
https://bugs.webkit.org/show_bug.cgi?id=153873

Reviewed by Eric Carlson.

Source/WebCore:

Adopt a new AVAssetResourceLoader API allowing clients to specify a NSURLSession object to
use for media loading, and control the use of this property with a new Setting.

page/Settings.cpp:

(WebCore::Settings::setAVFoundationNSURLSessionEnabled):

page/Settings.h:

(WebCore::Settings::isAVFoundationNSURLSessionEnabled):

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):

platform/spi/mac/AVFoundationSPI.h:

Source/WebKit/mac:

Add a WebKit preference to control the WebCore isAVFoundationNSURLSessionEnabled()
setting.

WebView/WebPreferenceKeysPrivate.h:
WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences setAVFoundationNSURLSessionEnabled:]):
(-[WebPreferences isAVFoundationNSURLSessionEnabled]):

WebView/WebPreferencesPrivate.h:
WebView/WebView.mm:

(-[WebView _preferencesChanged:]):

Source/WebKit2:

Add a WebKit2 preference to control the WebCore isAVFoundationNSURLSessionEnabled()
setting.

Shared/WebPreferencesDefinitions.h:
UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetAVFoundationNSURLSessionEnabled):
(WKPreferencesGetAVFoundationNSURLSessionEnabled):

UIProcess/API/C/WKPreferencesRef.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

12:55 PM Changeset in webkit [196327] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.0.3/Source/WebCore

Merged r195975. rdar://problem/24354546

12:54 PM Changeset in webkit [196326] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.0.3/Source

Versioning.

12:52 PM Changeset in webkit [196325] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Limit max and min zoom factor of Inspector
https://bugs.webkit.org/show_bug.cgi?id=154041
<rdar://problem/24571326>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-09
Reviewed by Brian Burg.

Chose reasonable zoom levels that looked good to my eye and
roughly matched Safari's page zoom levels.

UserInterface/Base/Main.js:

(WebInspector.contentLoaded):
Do not implicitly prevent default for zoom in/out keyboard shortcuts to
allow for a system beep if we do not do anything.

(WebInspector._increaseZoom):
(WebInspector._decreaseZoom):
Do not go beyond a max or min zoom level. Prevent default in the case
where we actually zoom, but don't prevent default where we do not
actually zoom to cause a system beep. Allow for a slight drift of
the floating point value as it increases / decreases by 0.2 at the
different zoom factors.

(WebInspector._resetZoom):
(WebInspector._showTabAtIndex):
Remove redundant prevent default calls, since it would happen
implicitly for these keyboard shortcuts.

12:52 PM Changeset in webkit [196324] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.0.3

New tag.

12:18 PM Changeset in webkit [196323] by fpizlo@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

Spread expressions are not fair game for direct binding
https://bugs.webkit.org/show_bug.cgi?id=154042
rdar://problem/24291413

Reviewed by Saam Barati.

Prior to this change we crashed on this:

var [x] = [...y];

Because NodesCodegen thinks that this is a direct binding. It's not, because we cannot
directly generate bytecode for "...y". This is a unique property of spread expressions, so
its sufficient to just bail out of direct binding if we see a spread expression. That's what
this patch does.

bytecompiler/NodesCodegen.cpp:

(JSC::ArrayPatternNode::emitDirectBinding):

tests/stress/spread-in-tail.js: Added.

(foo):
(catch):

11:50 AM Changeset in webkit [196322] by mmaxfield@apple.com

10 edits in trunk/Source/WebCore

Decouple font creation from font loading
https://bugs.webkit.org/show_bug.cgi?id=153414

Reviewed by Darin Adler.

Previously, CSSFontFaceSource never triggered a font download until that font was actually used. This means
that the function which triggers the download also has the goal of returning a font to use. However,
the CSS Font Loading JavaScript API requires being able to trigger a font download without this extra font
creation overhead.

In addition, this patch adds an explicit (and enforced) state transition diagram. The diagram looks like
this:

=> Success

Pending => Loading

=> Failure

Therefore, the API for CSSFontFaceSource has changed to expose the concept of these new states. This means
that its user (CSSSegmentedFontFaceSource) has been updated to handle each possible state that its constituent
CSSFontFaceSources may be in.

No new tests because there is no behavior change.

css/CSSFontFace.cpp:

(WebCore::CSSFontFace::allSourcesFailed): Renamed to make the name clearer.
(WebCore::CSSFontFace::addedToSegmentedFontFace): Use references instead of pointers.
(WebCore::CSSFontFace::removedFromSegmentedFontFace): Ditto.
(WebCore::CSSFontFace::adoptSource): Renamed to make the name clearer.
(WebCore::CSSFontFace::fontLoaded): Use references instead of pointers. Also, remove old dead code.
(WebCore::CSSFontFace::font): Adapt to the new API of CSSFontFaceSource.
(WebCore::CSSFontFace::isValid): Deleted.
(WebCore::CSSFontFace::addSource): Deleted.
(WebCore::CSSFontFace::notifyFontLoader): Deleted. Old dead code.
(WebCore::CSSFontFace::notifyLoadingDone): Deleted. Old dead code.

css/CSSFontFace.h:

(WebCore::CSSFontFace::create): Remove old dead code.
(WebCore::CSSFontFace::CSSFontFace): Use references instead of pointers.
(WebCore::CSSFontFace::loadState): Deleted. Remove old dead code.

css/CSSFontFaceSource.cpp:

(WebCore::CSSFontFaceSource::setStatus): Enforce state transitions.
(WebCore::CSSFontFaceSource::CSSFontFaceSource): Explicitly handle new state transitions.
(WebCore::CSSFontFaceSource::fontLoaded): Update for new states.
(WebCore::CSSFontFaceSource::load): Pulled out code from font().
(WebCore::CSSFontFaceSource::font): Moved code into load().
(WebCore::CSSFontFaceSource::isValid): Deleted.
(WebCore::CSSFontFaceSource::isDecodeError): Deleted.
(WebCore::CSSFontFaceSource::ensureFontData): Deleted.

css/CSSFontFaceSource.h: Much cleaner API.
css/CSSFontSelector.cpp:

(WebCore::createFontFace): Migrate to references instead of pointers. This requires a little
reorganization.
(WebCore::registerLocalFontFacesForFamily): Update to new CSSFontFaceSource API.
(WebCore::CSSFontSelector::addFontFaceRule): Ditto.
(WebCore::CSSFontSelector::getFontFace): Ditto.

css/CSSSegmentedFontFace.cpp:

(WebCore::CSSSegmentedFontFace::CSSSegmentedFontFace): Migrate to references instead of pointers.
(WebCore::CSSSegmentedFontFace::~CSSSegmentedFontFace): Ditto.
(WebCore::CSSSegmentedFontFace::fontLoaded): Remove old dead code.
(WebCore::CSSSegmentedFontFace::appendFontFace): Cleanup.
(WebCore::CSSSegmentedFontFace::fontRanges): Adopt to new API.
(WebCore::CSSSegmentedFontFace::pruneTable): Deleted.
(WebCore::CSSSegmentedFontFace::isLoading): Deleted. Old dead code.
(WebCore::CSSSegmentedFontFace::checkFont): Deleted. Ditto.
(WebCore::CSSSegmentedFontFace::loadFont): Deleted. Ditto.

css/CSSSegmentedFontFace.h:

(WebCore::CSSSegmentedFontFace::create): Migrate to references instead of pointers.
(WebCore::CSSSegmentedFontFace::fontSelector): Ditto.
(WebCore::CSSSegmentedFontFace::LoadFontCallback::~LoadFontCallback): Deleted.

loader/cache/CachedFont.cpp:

(WebCore::CachedFont::didAddClient): Migrate to references instead of pointers.
(WebCore::CachedFont::checkNotify): Ditto.

loader/cache/CachedFontClient.h:

(WebCore::CachedFontClient::fontLoaded): Ditto.

10:57 AM Changeset in webkit [196321] by andersca@apple.com

6 edits
1 copy in trunk/Source/WebKit2

All 32-bit plug-ins should use the XPC service
https://bugs.webkit.org/show_bug.cgi?id=154036
rdar://problem/16059483

Reviewed by Dan Bernstein.

Silverlight expects malloced memory from the tiny zone to be executable. It also expects
the data segment from its coreclr image to be executable.

Make this possible by:

Shimming mach_vm_map, making sure to add the VM_PROT_EXECUTABLE bit to any memory in the tiny zone.
Go through the address space, looking for any existing ranges from the tiny zone and mach_vm_protect them to be executable.
Register with dyld so we'll get callbacks whenever a library is bound, look for the coreclr image, and mach_vm_protect its DATA segment to be executable.

Platform/spi/Cocoa/DyldSPI.h: Copied from Source/WebKit2/PluginProcess/mac/PluginProcessShim.h.
PluginProcess/mac/PluginProcessMac.mm:

(WebKit::isMallocMemoryTag):
(WebKit::shouldMapMemoryExecutable):
(WebKit::initializeShim):
(WebKit::PluginProcess::platformInitializeProcess):

PluginProcess/mac/PluginProcessShim.h:
PluginProcess/mac/PluginProcessShim.mm:

(WebKit::shimMachVMMap):

UIProcess/Plugins/mac/PluginProcessProxyMac.mm:

(WebKit::PluginProcessProxy::platformGetLaunchOptions):
(WebKit::shouldUseXPC): Deleted.

WebKit2.xcodeproj/project.pbxproj:

10:33 AM Changeset in webkit [196320] by bshafiei@apple.com

3 edits
2 copies in tags/Safari-602.1.18.6

Merged r196004. rdar://problem/24439699

10:32 AM Changeset in webkit [196319] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.6/LayoutTests

Merged r196002. rdar://problem/19506502

10:31 AM Changeset in webkit [196318] by bshafiei@apple.com

14 edits
13 copies in tags/Safari-602.1.18.6

Merged r196001. rdar://problem/19506502

10:28 AM Changeset in webkit [196317] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.6/Source

Versioning.

10:25 AM Changeset in webkit [196316] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.6

New tag.

10:25 AM Changeset in webkit [196315] by Csaba Osztrogonác

4 edits in trunk

[GTK][EFL] Fix several build configuration related to SamplingProfiler after r196245
https://bugs.webkit.org/show_bug.cgi?id=154033

Reviewed by Michael Catanzaro.

Source/cmake/WebKitFeatures.cmake:

Source/WTF:

wtf/Platform.h:

10:16 AM Changeset in webkit [196314] by Alan Bujtas

95 edits
1 add in trunk/LayoutTests

[Win] Rebaseline after r196244.

Unreviewed test gardening.

platform/win/css3/unicode-bidi-isolate-basic-expected.txt:
platform/win/fast/block/float/overhanging-tall-block-expected.txt:
platform/win/fast/block/positioning/auto/vertical-rl/007-expected.txt:
platform/win/fast/borders/border-antialiasing-expected.txt:
platform/win/fast/clip/001-expected.txt:
platform/win/fast/clip/013-expected.txt:
platform/win/fast/clip/014-expected.txt:
platform/win/fast/clip/outline-overflowClip-expected.txt:
platform/win/fast/css/clip-zooming-expected.txt:
platform/win/fast/frames/flattening/iframe-flattening-offscreen-expected.txt: Added.
platform/win/fast/inline/left-right-center-inline-alignment-in-ltr-and-rtl-blocks-expected.txt:
platform/win/fast/line-grid/line-grid-inside-columns-expected.txt:
platform/win/fast/line-grid/line-grid-into-columns-expected.txt:
platform/win/fast/lists/scrolled-marker-paint-expected.txt:
platform/win/fast/multicol/client-rects-expected.txt:
platform/win/fast/multicol/column-break-with-balancing-expected.txt:
platform/win/fast/multicol/column-rules-expected.txt:
platform/win/fast/multicol/column-rules-stacking-expected.txt:
platform/win/fast/multicol/columns-shorthand-parsing-expected.txt:
platform/win/fast/multicol/float-paginate-complex-expected.txt:
platform/win/fast/multicol/float-paginate-empty-lines-expected.txt:
platform/win/fast/multicol/float-paginate-expected.txt:
platform/win/fast/multicol/layers-in-multicol-expected.txt:
platform/win/fast/multicol/layers-split-across-columns-expected.txt:
platform/win/fast/multicol/max-height-columns-block-expected.txt:
platform/win/fast/multicol/nested-columns-expected.txt:
platform/win/fast/multicol/newmulticol/client-rects-expected.txt:
platform/win/fast/multicol/overflow-across-columns-expected.txt:
platform/win/fast/multicol/overflow-across-columns-percent-height-expected.txt:
platform/win/fast/multicol/overflow-unsplittable-expected.txt:
platform/win/fast/multicol/paginate-block-replaced-expected.txt:
platform/win/fast/multicol/pagination/BottomToTop-bt-expected.txt:
platform/win/fast/multicol/pagination/BottomToTop-lr-expected.txt:
platform/win/fast/multicol/pagination/BottomToTop-rl-expected.txt:
platform/win/fast/multicol/pagination/BottomToTop-tb-expected.txt:
platform/win/fast/multicol/pagination/LeftToRight-bt-expected.txt:
platform/win/fast/multicol/pagination/LeftToRight-rl-expected.txt:
platform/win/fast/multicol/pagination/LeftToRight-tb-expected.txt:
platform/win/fast/multicol/pagination/LeftToRight-tb-hittest-expected.txt:
platform/win/fast/multicol/pagination/RightToLeft-bt-expected.txt:
platform/win/fast/multicol/pagination/RightToLeft-lr-expected.txt:
platform/win/fast/multicol/pagination/RightToLeft-rl-dynamic-expected.txt:
platform/win/fast/multicol/pagination/RightToLeft-rl-expected.txt:
platform/win/fast/multicol/pagination/RightToLeft-rl-hittest-expected.txt:
platform/win/fast/multicol/pagination/RightToLeft-tb-expected.txt:
platform/win/fast/multicol/pagination/TopToBottom-bt-expected.txt:
platform/win/fast/multicol/pagination/TopToBottom-lr-expected.txt:
platform/win/fast/multicol/pagination/TopToBottom-rl-expected.txt:
platform/win/fast/multicol/positive-leading-expected.txt:
platform/win/fast/multicol/scrolling-column-rules-expected.txt:
platform/win/fast/multicol/scrolling-overflow-expected.txt:
platform/win/fast/multicol/span/anonymous-style-inheritance-expected.txt:
platform/win/fast/multicol/span/span-as-immediate-child-complex-splitting-expected.txt:
platform/win/fast/multicol/span/span-as-immediate-child-generated-content-expected.txt:
platform/win/fast/multicol/span/span-as-immediate-child-property-removal-expected.txt:
platform/win/fast/multicol/span/span-as-immediate-columns-child-dynamic-expected.txt:
platform/win/fast/multicol/span/span-as-immediate-columns-child-expected.txt:
platform/win/fast/multicol/span/span-as-immediate-columns-child-removal-expected.txt:
platform/win/fast/multicol/span/span-as-nested-columns-child-dynamic-expected.txt:
platform/win/fast/multicol/span/span-as-nested-columns-child-expected.txt:
platform/win/fast/multicol/span/span-margin-collapsing-expected.txt:
platform/win/fast/multicol/table-vertical-align-expected.txt:
platform/win/fast/multicol/tall-image-behavior-expected.txt:
platform/win/fast/multicol/vertical-lr/column-break-with-balancing-expected.txt:
platform/win/fast/multicol/vertical-lr/column-rules-expected.txt:
platform/win/fast/multicol/vertical-lr/float-multicol-expected.txt:
platform/win/fast/multicol/vertical-lr/float-paginate-complex-expected.txt:
platform/win/fast/multicol/vertical-lr/float-paginate-expected.txt:
platform/win/fast/multicol/vertical-lr/nested-columns-expected.txt:
platform/win/fast/multicol/vertical-rl/column-break-with-balancing-expected.txt:
platform/win/fast/multicol/vertical-rl/column-rules-expected.txt:
platform/win/fast/multicol/vertical-rl/float-multicol-expected.txt:
platform/win/fast/multicol/vertical-rl/float-paginate-complex-expected.txt:
platform/win/fast/multicol/vertical-rl/float-paginate-expected.txt:
platform/win/fast/multicol/vertical-rl/nested-columns-expected.txt:
platform/win/fast/overflow/clip-rects-fixed-ancestor-expected.txt:
platform/win/fast/overflow/float-in-relpositioned-expected.txt:
platform/win/fast/overflow/overflow-auto-position-absolute-expected.txt:
platform/win/fast/overflow/overflow-rtl-expected.txt:
platform/win/fast/overflow/paged-x-div-expected.txt:
platform/win/fast/overflow/paged-x-div-with-column-gap-expected.txt:
platform/win/fast/overflow/paged-x-on-root-expected.txt:
platform/win/fast/overflow/paged-x-with-column-gap-expected.txt:
platform/win/fast/overflow/paged-y-div-expected.txt:
platform/win/fast/overflow/scroll-nested-positioned-layer-in-overflow-expected.txt:
platform/win/fast/repaint/box-shadow-h-expected.txt:
platform/win/fast/repaint/box-shadow-v-expected.txt:
platform/win/fast/repaint/layer-outline-expected.txt:
platform/win/fast/repaint/layer-outline-horizontal-expected.txt:
platform/win/fast/table/edge-offsets-expected.txt:
platform/win/fast/transforms/overflow-with-transform-expected.txt:
platform/win/printing/single-line-must-not-be-split-into-two-pages-expected.txt:
platform/win/scrollbars/scrollbars-on-positioned-content-expected.txt:
platform/win/svg/custom/getscreenctm-in-scrollable-div-area-nested-expected.txt:
platform/win/svg/custom/image-rescale-clip-expected.txt:

9:40 AM Changeset in webkit [196313] by beidson@apple.com

5 edits
2 adds in trunk/Source/WebCore

Modern IDB: IDBOpenDBRequests leak.
https://bugs.webkit.org/show_bug.cgi?id=154032

Reviewed by Alex Christensen.

No new tests (Currently untestable).

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:

Add a simple Event subclass that holds a ref to an IDBRequest, to make sure that we
drop the last ref to the request after its last event fires or is otherwise destroyed:

Modules/indexeddb/IDBRequestCompletionEvent.cpp: Added.

(WebCore::IDBRequestCompletionEvent::IDBRequestCompletionEvent):

Modules/indexeddb/IDBRequestCompletionEvent.h: Added.

(WebCore::IDBRequestCompletionEvent::create):

Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:

(WebCore::IDBClient::IDBOpenDBRequest::onError): IDBRequestCompletionEvent instead of Event.
(WebCore::IDBClient::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit): Ditto.
(WebCore::IDBClient::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion): Ditto.
(WebCore::IDBClient::IDBOpenDBRequest::onSuccess): Ditto.

Modules/indexeddb/client/IDBTransactionImpl.cpp:

(WebCore::IDBClient::IDBTransaction::dispatchEvent): After setting up the request's

completion event to fire, clear the back-ref to the request.

9:38 AM Changeset in webkit [196312] by Csaba Osztrogonác

2 edits in trunk/Tools

[EFL] Remove eail related cruft after r195725
https://bugs.webkit.org/show_bug.cgi?id=154030

Reviewed by Alex Christensen.

efl/jhbuildrc:

9:35 AM Changeset in webkit [196311] by Csaba Osztrogonác

2 edits
3 deletes in trunk/Tools

[EFL] Remove LLVM related cruft after r196077
https://bugs.webkit.org/show_bug.cgi?id=154031

Reviewed by Alex Christensen.

efl/jhbuild.modules:
efl/patches/llvm-elf-add-stackmaps-arm64.patch: Removed.
efl/patches/llvm-elf-allow-fde-references-outside-the-2gb-range-arm64.patch: Removed.
efl/patches/llvm-version-arm64.patch: Removed.

9:13 AM Changeset in webkit [196310] by eric.carlson@apple.com

2 edits in trunk/Source/WebKit/mac

checkValidity() sometimes asserts in WebUserMediaClient::pageDestroyed
https://bugs.webkit.org/show_bug.cgi?id=154029
<rdar://problem/24065022>

Reviewed by Alex Christensen.

WebCoreSupport/WebUserMediaClient.mm:

(WebUserMediaClient::pageDestroyed): Copy map keys to a vector and clear the map before

enumerating the vector and canceling the requests. ASSERT that the map is not modified
during cleanup. Clean up the permission check map.

(WebUserMediaClient::requestUserMediaAccess): Add the request to the map before calling the

UI delegate in case it works synchronously (as it does in DRT).

(WebUserMediaClient::checkUserMediaPermission): Ditto.
(WebUserMediaClient::cancelUserMediaPermissionCheck): White-space cleanup.
(-[WebUserMediaPolicyListener allow]): Ditto.

9:09 AM Changeset in webkit [196309] by Alan Bujtas

82 edits
12 copies
2 adds in trunk/LayoutTests

[iOS] Rebaseline after r196244.

Unreviewed test gardening.

platform/ios-simulator/compositing/geometry/clipping-foreground-expected.txt:
platform/ios-simulator/compositing/geometry/root-layer-update-expected.txt:
platform/ios-simulator/compositing/overflow/overflow-scroll-expected.txt:
platform/ios-simulator/compositing/overflow/parent-overflow-expected.txt:
platform/ios-simulator/compositing/overflow/scrollbar-painting-expected.txt:
platform/ios-simulator/compositing/sibling-positioning-expected.txt:
platform/ios-simulator/css2.1/20110323/abspos-non-replaced-width-margin-000-expected.txt: Added.
platform/ios-simulator/css2.1/20110323/abspos-replaced-width-margin-000-expected.txt: Added.
platform/ios-simulator/css3/blending/blend-mode-overflow-expected.txt:
platform/ios-simulator/css3/unicode-bidi-isolate-basic-expected.txt:
platform/ios-simulator/fast/block/float/overhanging-tall-block-expected.txt:
platform/ios-simulator/fast/borders/border-antialiasing-expected.txt:
platform/ios-simulator/fast/clip/001-expected.txt:
platform/ios-simulator/fast/clip/013-expected.txt:
platform/ios-simulator/fast/clip/014-expected.txt:
platform/ios-simulator/fast/clip/016-expected.txt:
platform/ios-simulator/fast/clip/outline-overflowClip-expected.txt:
platform/ios-simulator/fast/css/clip-zooming-expected.txt:
platform/ios-simulator/fast/frames/flattening/iframe-flattening-offscreen-expected.txt:
platform/ios-simulator/fast/inline/left-right-center-inline-alignment-in-ltr-and-rtl-blocks-expected.txt:
platform/ios-simulator/fast/line-grid/line-grid-inside-columns-expected.txt:
platform/ios-simulator/fast/line-grid/line-grid-into-columns-expected.txt:
platform/ios-simulator/fast/lists/scrolled-marker-paint-expected.txt:
platform/ios-simulator/fast/multicol/client-rects-expected.txt:
platform/ios-simulator/fast/multicol/column-break-with-balancing-expected.txt:
platform/ios-simulator/fast/multicol/column-rules-expected.txt:
platform/ios-simulator/fast/multicol/column-rules-stacking-expected.txt:
platform/ios-simulator/fast/multicol/columns-shorthand-parsing-expected.txt:
platform/ios-simulator/fast/multicol/float-paginate-complex-expected.txt:
platform/ios-simulator/fast/multicol/float-paginate-empty-lines-expected.txt:
platform/ios-simulator/fast/multicol/float-paginate-expected.txt:
platform/ios-simulator/fast/multicol/layers-in-multicol-expected.txt:
platform/ios-simulator/fast/multicol/layers-split-across-columns-expected.txt:
platform/ios-simulator/fast/multicol/max-height-columns-block-expected.txt:
platform/ios-simulator/fast/multicol/nested-columns-expected.txt:
platform/ios-simulator/fast/multicol/newmulticol/client-rects-expected.txt:
platform/ios-simulator/fast/multicol/overflow-across-columns-expected.txt:
platform/ios-simulator/fast/multicol/overflow-across-columns-percent-height-expected.txt:
platform/ios-simulator/fast/multicol/overflow-unsplittable-expected.txt:
platform/ios-simulator/fast/multicol/paginate-block-replaced-expected.txt:
platform/ios-simulator/fast/multicol/pagination/BottomToTop-bt-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/TopToBottom-bt-expected.txt.
platform/ios-simulator/fast/multicol/pagination/BottomToTop-lr-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/TopToBottom-lr-expected.txt.
platform/ios-simulator/fast/multicol/pagination/BottomToTop-rl-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/TopToBottom-rl-expected.txt.
platform/ios-simulator/fast/multicol/pagination/BottomToTop-tb-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/TopToBottom-bt-expected.txt.
platform/ios-simulator/fast/multicol/pagination/LeftToRight-bt-expected.txt:
platform/ios-simulator/fast/multicol/pagination/LeftToRight-rl-expected.txt:
platform/ios-simulator/fast/multicol/pagination/LeftToRight-tb-expected.txt:
platform/ios-simulator/fast/multicol/pagination/RightToLeft-bt-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/LeftToRight-tb-expected.txt.
platform/ios-simulator/fast/multicol/pagination/RightToLeft-lr-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/LeftToRight-rl-expected.txt.
platform/ios-simulator/fast/multicol/pagination/RightToLeft-rl-dynamic-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/LeftToRight-rl-expected.txt.
platform/ios-simulator/fast/multicol/pagination/RightToLeft-rl-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/LeftToRight-rl-expected.txt.
platform/ios-simulator/fast/multicol/pagination/RightToLeft-tb-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/pagination/LeftToRight-tb-expected.txt.
platform/ios-simulator/fast/multicol/pagination/TopToBottom-bt-expected.txt:
platform/ios-simulator/fast/multicol/pagination/TopToBottom-lr-expected.txt:
platform/ios-simulator/fast/multicol/pagination/TopToBottom-rl-expected.txt:
platform/ios-simulator/fast/multicol/positive-leading-expected.txt:
platform/ios-simulator/fast/multicol/scrolling-column-rules-expected.txt:
platform/ios-simulator/fast/multicol/scrolling-overflow-expected.txt:
platform/ios-simulator/fast/multicol/span/anonymous-style-inheritance-expected.txt:
platform/ios-simulator/fast/multicol/span/span-as-immediate-child-complex-splitting-expected.txt:
platform/ios-simulator/fast/multicol/span/span-as-immediate-child-generated-content-expected.txt:
platform/ios-simulator/fast/multicol/span/span-as-immediate-child-property-removal-expected.txt:
platform/ios-simulator/fast/multicol/span/span-as-immediate-columns-child-dynamic-expected.txt:
platform/ios-simulator/fast/multicol/span/span-as-immediate-columns-child-expected.txt:
platform/ios-simulator/fast/multicol/span/span-as-immediate-columns-child-removal-expected.txt:
platform/ios-simulator/fast/multicol/span/span-as-nested-columns-child-dynamic-expected.txt:
platform/ios-simulator/fast/multicol/span/span-as-nested-columns-child-expected.txt:
platform/ios-simulator/fast/multicol/span/span-margin-collapsing-expected.txt:
platform/ios-simulator/fast/multicol/table-vertical-align-expected.txt:
platform/ios-simulator/fast/multicol/tall-image-behavior-expected.txt:
platform/ios-simulator/fast/multicol/vertical-lr/column-break-with-balancing-expected.txt:
platform/ios-simulator/fast/multicol/vertical-lr/column-rules-expected.txt:
platform/ios-simulator/fast/multicol/vertical-lr/float-multicol-expected.txt:
platform/ios-simulator/fast/multicol/vertical-lr/float-paginate-complex-expected.txt:
platform/ios-simulator/fast/multicol/vertical-lr/float-paginate-expected.txt:
platform/ios-simulator/fast/multicol/vertical-lr/nested-columns-expected.txt:
platform/ios-simulator/fast/multicol/vertical-rl/column-break-with-balancing-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/vertical-lr/column-break-with-balancing-expected.txt.
platform/ios-simulator/fast/multicol/vertical-rl/column-rules-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/vertical-lr/column-rules-expected.txt.
platform/ios-simulator/fast/multicol/vertical-rl/float-multicol-expected.txt:
platform/ios-simulator/fast/multicol/vertical-rl/float-paginate-complex-expected.txt: Copied from LayoutTests/platform/ios-simulator/fast/multicol/vertical-lr/float-paginate-complex-expected.txt.
platform/ios-simulator/fast/multicol/vertical-rl/float-paginate-expected.txt:
platform/ios-simulator/fast/multicol/vertical-rl/nested-columns-expected.txt:
platform/ios-simulator/fast/overflow/float-in-relpositioned-expected.txt:
platform/ios-simulator/fast/overflow/overflow-auto-position-absolute-expected.txt:
platform/ios-simulator/fast/overflow/overflow-rtl-expected.txt:
platform/ios-simulator/fast/overflow/paged-x-div-expected.txt:
platform/ios-simulator/fast/overflow/paged-x-div-with-column-gap-expected.txt:
platform/ios-simulator/fast/overflow/paged-x-on-root-expected.txt:
platform/ios-simulator/fast/overflow/paged-x-with-column-gap-expected.txt:
platform/ios-simulator/fast/overflow/paged-y-div-expected.txt:
platform/ios-simulator/fast/overflow/scroll-nested-positioned-layer-in-overflow-expected.txt:
platform/ios-simulator/fast/regions/repaint/region-painting-via-layout-expected.txt:
platform/ios-simulator/fast/table/edge-offsets-expected.txt:
platform/ios-simulator/fast/transforms/overflow-with-transform-expected.txt:
platform/ios-simulator/svg/custom/image-rescale-clip-expected.txt:

4:38 AM Changeset in webkit [196308] by commit-queue@webkit.org

7 edits in trunk/Source

Unreviewed, rolling out r196286.
https://bugs.webkit.org/show_bug.cgi?id=154026

Looks like 5% iOS PLT regression (Requested by kling on
#webkit).

Reverted changeset:

"[iOS] Throw away some unlinked code when navigating to a new
page."
https://bugs.webkit.org/show_bug.cgi?id=154014
http://trac.webkit.org/changeset/196286

12:23 AM Changeset in webkit [196307] by Carlos Garcia Campos

2 edits in trunk/Source/WebKit2

possible buffer overrun in Connection::processMessage of Source/WebKit2/Platform/IPC/unix/ConnectionUnix.cpp
https://bugs.webkit.org/show_bug.cgi?id=153637

Patch by Fujii Hironori <Hironori.Fujii@jp.sony.com> on 2016-02-09
Reviewed by Carlos Garcia Campos.

Platform/IPC/unix/ConnectionUnix.cpp:

(IPC::Connection::processMessage): Fix invalid arguments of memmove.

12:19 AM Changeset in webkit [196306] by Carlos Garcia Campos

1 copy in releases/WebKitGTK/webkit-2.11.5

WebKitGTK+ 2.11.5

12:07 AM Changeset in webkit [196305] by Carlos Garcia Campos

4 edits in trunk

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.11.5 release.

Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

gtk/NEWS: Add release notes for 2.11.5.

Feb 8, 2016:

9:26 PM Changeset in webkit [196304] by jonlee@apple.com

7 edits in trunk/PerformanceTests

Address Said's comments on the benchmark, and do some clean up.

Animometer/developer.html:
Animometer/resources/debug-runner/animometer.css: Add styles for averages.
Animometer/resources/debug-runner/animometer.js: Use the right

Strings constants.

Animometer/resources/debug-runner/graph.js:

(_addRegressionLine): Add missing code to draw the line and standard
deviation highlight.
(onGraphTypeChanged): Remove unneeded variables
(onTimeGraphOptionsChanged):

Animometer/resources/runner/benchmark-runner.js:

(_runBenchmarkAndRecordResults): Rename samplers to suiteResults and
_suitesSamplers to _suitesResults.

Animometer/tests/resources/main.js:

(results): Call processSamples().
(update): Change sampling timestamp comparison.
(_animateLoop): Move shouldStop call to before the update.

Animometer/tests/resources/sampler.js:

(process): Rename to processSamples().

9:15 PM Changeset in webkit [196303] by Chris Dumez

21 edits in trunk

Attribute getters should not require an explicit 'this' value for Window properties
https://bugs.webkit.org/show_bug.cgi?id=153968

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline W3C test now that more checks are passing.

web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Attribute getters should not require an explicit 'this' value for
Window properties. This is because the Window interface is marked
as [ImplicitThis]:

This matches the behavior of Firefox and the expectations of the W3C
web-platform-tests.

No new tests, already covered by existing tests.

bindings/scripts/CodeGeneratorJS.pm:

In attribute getters of an interface marked as [ImplicitThis],
if 'thisValue' is undefined or null, fall back to using the
global object as 'thisValue'.

bindings/scripts/IDLAttributes.txt:

Add support for [ImplicitThis]:
http://heycam.github.io/webidl/#ImplicitThis

bindings/scripts/test/JS/JSTestEventConstructor.cpp:
bindings/scripts/test/JS/JSTestException.cpp:
bindings/scripts/test/JS/JSTestInterface.cpp:
bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
bindings/scripts/test/JS/JSTestNode.cpp:
bindings/scripts/test/JS/JSTestNondeterministic.cpp:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
bindings/scripts/test/JS/JSTestTypedefs.cpp:
bindings/scripts/test/JS/JSattribute.cpp:

Rebaseline bindings tests.

page/DOMWindow.idl:

Mark Window as [ImplicitThis]:
http://heycam.github.io/webidl/#ImplicitThis

LayoutTests:

Rebaseline existing tests now that more checks are passing.

fast/dom/Window/getOwnPropertyDescriptor-other-window-expected.txt:
fast/dom/Window/getOwnPropertyDescriptor-other-window.html:
js/getOwnPropertyDescriptor-window-attributes-expected.txt:

7:46 PM Changeset in webkit [196302] by keith_miller@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

Error construction for inlined operations should not use the inliner's CodeBlock
https://bugs.webkit.org/show_bug.cgi?id=154021

Reviewed by Mark Lam.

Previously, if one function, A, was inlined into another function, B, in the DFG/FTL
we would use B's DFG/FTL CodeBlock to construct source information about the Error.
We would correctly compute the bytecodeOffset in A for the an expression but we would
not use one of A's CodeBlocks when looking up source. This caused crashes during
operationIn as we expected to be able to find the text "in" in the source.

runtime/ErrorInstance.cpp:

(JSC::appendSourceToError):

tests/stress/inlined-error-gets-correct-codeblock-for-bytecodeoffset.js: Added.

(map):
(n):
(one):
(catch):

7:33 PM Changeset in webkit [196301] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Uncaught exception merging script profiler records
https://bugs.webkit.org/show_bug.cgi?id=154004

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Brian Burg.

UserInterface/Controllers/TimelineManager.js:

(WebInspector.TimelineManager.prototype._mergeScriptProfileRecords):
Stop if we've merged all script profiler records.

7:31 PM Changeset in webkit [196300] by sbarati@apple.com

2 edits in trunk/Source/JavaScriptCore

runtimeTypeForValue should protect against seeing TDZ value
https://bugs.webkit.org/show_bug.cgi?id=154023

Reviewed by Michael Saboff.

There are a few back traces I've seen from crashes that bottom out
inside runtimeTypeForValue. I haven't been able to reproduce
any such crash, but it's likely that we're encountering the
empty JSValue. It's better to just have this function protect
against seeing the empty value instead of dereferencing a null
pointer when it thinks the value is a cell.

runtime/RuntimeType.cpp:

(JSC::runtimeTypeForValue):

7:30 PM Changeset in webkit [196299] by jonlee@apple.com

2 edits in trunk/PerformanceTests

Teach Controller to measure intervals, and turn off the frame length estimator.

Animometer/tests/resources/main.js: Default interval length is 100 ms.

(start): Set the first interval.
(_measureAndResetInterval): Reports the average frame length of the interval that just
completed, and sets up the next interval.
(update): If there is no length, then just use the estimator per frame, otherwise the
estimator measures per interval. Add a didFinishInterval for subclasses to process
prior to recording the sample. Update tune() to include whether an interval had
finished.
(StepController): Step controllers don't measure on an interval basis.

7:30 PM Changeset in webkit [196298] by jonlee@apple.com

2 edits in trunk/PerformanceTests

Minor refactoring. Rename Controller._estimator to Controller._frameLengthEstimator
and switch the parameters for start(), update(), and tune(), so that the timestamp
is first and stage is second.

Animometer/tests/resources/main.js:

7:30 PM Changeset in webkit [196297] by jonlee@apple.com

5 edits in trunk/PerformanceTests

Move ResultsTable functionality not needed for release tests out.
Move reporting of score and mean to selection of the time-based graph.

Animometer/developer.html: Rename graph-options to time-graph-options.
Animometer/resources/debug-runner/animometer.js:

(DeveloperResultsTable): Moved from runner/animometer.js. Switch from mean
values to "average" objects which can hold stdev. Move graph button and
calculation of noisy measurements here. Sophisticated header processing
is not needed in release suite.
(populateTable): Use DeveloperResultsTable.

Animometer/resources/debug-runner/graph.js: Pull time graph creation to

its own function, and add a new onGraphTypeChanged handler in preparation
of a complexity graph to be added later.

Animometer/resources/runner/animometer.js:

(ResultsTable): Simplify to just handle test names and scores.

7:30 PM Changeset in webkit [196296] by jonlee@apple.com

5 edits in trunk/PerformanceTests

Tests: reuse objects already made.

Avoid thrash of object creation and removal by maintaining an index that
moves along the array as the adjust values change. If the tune value
requires more objects than the maximum size of the object array, then create
new objects. This means that the object array size never decreases.

Animometer/tests/master/resources/canvas-stage.js: Maintain a separate

offsetIndex. For these tests, we want to avoid drawing the oldest objects,
so the scene will draw the object at offsetIndex to the end of the array.
(tune): Reverse the logic since "removal" of objects is much simpler and
involves simply changing the offsetIndex.
(animate): Update the for loop to draw from offsetIndex to the end.
(complexity): Update the definition.

Animometer/tests/master/resources/canvas-tests.js: Maintain a separate

offsetIndex. For these tests, we want to avoid drawing the newest objects,
so the scene will draw the object at index 0 to the object at offsetIndex.
(SimpleCanvasStage.animate): Fly-by removal of local stage variable,
which is unneeded. Update the for loop to draw from offsetIndex to the end.

Animometer/tests/simple/resources/simple-canvas-paths.js:

(SimpleCanvasStage.animate): Update the for loop to draw from 0 to
offsetIndex.

Animometer/tests/simple/resources/simple-canvas.js:

(tune): Update logic. Here, offsetIndex represents the boundary of the last
index to render.
(animate): Update the for loop to draw from 0 to offsetIndex.
(complexity): Update the definition.

7:30 PM Changeset in webkit [196295] by jonlee@apple.com

7 edits in trunk/PerformanceTests

Tests: refactor and update styles.

Animometer/tests/resources/main.js: Add helper methods that return

a color that hue rotates based on the date, and a counter value that
increases based on the date. Fix randomInt() to not bias against the min and
max values.

Animometer/tests/master/resources/canvas-tests.js: Use new helper methods.
Animometer/tests/master/resources/dom-particles.js: Ditto.
Animometer/tests/master/resources/particles.js: Ditto.
Animometer/tests/simple/resources/simple-canvas-paths.js: Refactor to

use a rotating color instead of a random color. The fast switching of color
is too vivid to watch.

Animometer/tests/bouncing-particles/resources/bouncing-svg-shapes.js:

(BouncingSvgParticlesStage.call.createGradient): Fix the gradient so
that the last stop is located at the end.

7:30 PM Changeset in webkit [196294] by jonlee@apple.com

12 edits in trunk/PerformanceTests

Refactor tune() to not return the complexity of the scene.

We have stage.complexity() now, so returning the complexity through tune
is unnecessary.

Animometer/tests/bouncing-particles/resources/bouncing-particles.js:
Animometer/tests/master/resources/canvas-stage.js:
Animometer/tests/master/resources/particles.js:
Animometer/tests/misc/resources/canvas-electrons.js:
Animometer/tests/misc/resources/canvas-stars.js:
Animometer/tests/resources/main.js:
Animometer/tests/simple/resources/simple-canvas.js:
Animometer/tests/simple/resources/tiled-canvas-image.js:
Animometer/tests/template/resources/template-canvas.js:
Animometer/tests/template/resources/template-css.js:
Animometer/tests/template/resources/template-svg.js:
Animometer/tests/text/resources/layering-text.js:

7:30 PM Changeset in webkit [196293] by jonlee@apple.com

4 edits in trunk/PerformanceTests

Make the fixed controller a step controller instead. Halfway through the test
it will bump up the complexity 4-fold. Calculate the step timestamp using options
instead of a separate parameter to the Controller constructor.

Animometer/developer.html: Change value to "step"
Animometer/resources/debug-runner/animometer.js:

(window.suitesManager.updateEditsElementsState): Show number inputs when set to "step".

Animometer/tests/resources/main.js:

(update): Provide a hook for subclasses to tune.
(StepController): Maintain a flag determining whether we've stepped, and the time
we should step.
(Benchmark): Use the new StepController.

7:30 PM Changeset in webkit [196292] by jonlee@apple.com

5 edits in trunk/PerformanceTests

Adjust the FPS graph scale.

Instead of making the FPS graph linearly scale, scale it based on the frame length,
but show the data in terms of FPS. Because it is inversely proportional, and most
of the data never gets below 20, concentrate the axis from 20-60 FPS, since otherwise
over half of the available graph space ends up blank.

This means we should convert all of the FPS data to frame length data.

Animometer/resources/debug-runner/graph.js: Update the domain to be based on

frame length in milliseconds instead of FPS. Update the cursor to consider all of the
values being shown, and then pick the min and max values to represent the length of the
cursor.

Animometer/resources/runner/animometer.js:
Animometer/resources/strings.js:
Animometer/tests/resources/main.js:

(processSamples): Add the ability to only sample a range of the data instead of everything
after an offset index. Update sampler to record the frame lengths instead of the frame
rate.

7:30 PM Changeset in webkit [196291] by jonlee@apple.com

4 edits in trunk/PerformanceTests

Add option to use different methods for retrieving a timestamp.

Animometer/developer.html: Add performance.now and Date.now options.
Animometer/resources/runner/animometer.js: Default to performance.now.

(window.benchmarkController.startBenchmark):

Animometer/tests/resources/main.js: Tie the desired method to _getTimestamp.

(run): Use _getTimestamp.
(_animateLoop): Ditto.

7:30 PM Changeset in webkit [196290] by jonlee@apple.com

7 edits in trunk/PerformanceTests

Allow adding any number of markers to the graph. The markers can be labeled
and contain timestamp and sample index data. Make it a part of the controller
rather than keeping it in the sampler.

Animometer/resources/debug-runner/animometer.css: Add styles for markers
Animometer/resources/debug-runner/graph.js: Create the markers and add

text labels.

Animometer/resources/runner/animometer.js: Assume the samplingTimeOffset

is just one of the marks provided.

Animometer/resources/strings.js: Add Strings.json.marks.
Animometer/tests/resources/main.js:

(Controller): Keep marks here. They are keyed by the marker name, so no two
markers should have the same name.
(recordFirstSample): Refactor to use mark.
(mark): Allows for arbitrary data if needed later. The timestamp maintained
is relative to the absolute start timestamp.
(containsMark): Checks whether a mark with a specific comment exists.
(processSamples): Removes the _startTimestamp offset from the marks before
setting it in results.

Animometer/tests/resources/sampler.js: Remove marks.

7:30 PM Changeset in webkit [196289] by jonlee@apple.com

22 edits in trunk/PerformanceTests

Get rid of options member variable in Benchmark.

Options are only needed when initializing the stage or benchmark, so there's no
need to also keep a reference to it.

Animometer/tests/resources/main.js: Get rid of options variable in Benchmark.

Pass options to Controllers and Stages.
(Controller.Utilities.createClass):
(Benchmark.Utilities.createClass):
(get options): Deleted.

Animometer/tests/bouncing-particles/resources/bouncing-canvas-images.js:
Animometer/tests/bouncing-particles/resources/bouncing-canvas-particles.js:
Animometer/tests/bouncing-particles/resources/bouncing-canvas-shapes.js:
Animometer/tests/bouncing-particles/resources/bouncing-css-images.js:
Animometer/tests/bouncing-particles/resources/bouncing-css-shapes.js:
Animometer/tests/bouncing-particles/resources/bouncing-particles.js:
Animometer/tests/bouncing-particles/resources/bouncing-svg-images.js:
Animometer/tests/bouncing-particles/resources/bouncing-svg-shapes.js:
Animometer/tests/master/resources/canvas-stage.js:
Animometer/tests/master/resources/canvas-tests.js:
Animometer/tests/master/resources/particles.js:
Animometer/tests/misc/resources/canvas-electrons.js:
Animometer/tests/misc/resources/canvas-stars.js:
Animometer/tests/misc/resources/compositing-transforms.js:
Animometer/tests/simple/resources/simple-canvas-paths.js:
Animometer/tests/simple/resources/tiled-canvas-image.js:
Animometer/tests/template/resources/template-canvas.js:
Animometer/tests/template/resources/template-css.js:
Animometer/tests/template/resources/template-svg.js:
Animometer/tests/text/resources/layering-text.js:

7:25 PM Changeset in webkit [196288] by jonlee@apple.com

10 edits in trunk/PerformanceTests

Update how the benchmark is run
https://bugs.webkit.org/show_bug.cgi?id=153960

Provisionally reviewed by Said Abou-Hallawa.

Introduce the notion of a Controller. It is responsible for recording, updating,
and processing the statistics and complexity of the benchmark. This allows
plugging in different Controllers.

This strips most of the functionality from Animator and BenchmarkState, so fold
what's left into Benchmark. Now, Benchmarks only own a stage and a controller, but
are responsible for driving the animation loop.

Rewrite Animator._shouldRequestAnotherFrame into two different Controllers. One
maintains a fixed complexity, and the other adapts the complexity to meet a
fixed FPS.

Fix the Kalman estimator to be modeled on a scalar variable with no model.

Animometer/tests/resources/main.js: Remove BenchmarkState and Animator, and

replace it with a Controller. Add a FixedController and refactor the previous controller
to an AdaptiveController.

(Controller): Controllers own the estimator and the sampler. When a new frame is
displayed, the animation loop calls update(). The estimator and sampler record
stats, then tune. Samplers can track multiple series of data. The basic controller
tracks timestamp, complexity, and estimated frame rate.

The Kalman estimation is based on the frame length rather than the frame

rate. Because FPS is inverse proportional to frame length, in the case where the measured
frame length is very small, the FPS ends up being a wildly large number (in the order of
600-1000 "FPS"), and it pulls the estimator up drastically enough that it takes a while
for it to settle back down. Using frame length reduces the impact of these spikes.

Converging the estimation takes enough time to avoid initializing it immediately

when the benchmark starts. Instead, the benchmark runs for a brief period of time (100ms)
before running it in earnest. Allow controllers an opportunity to set the complexity
before starting recording.

When the benchmark is complete, the controller has an opportunity to process

the samples. The default implementation calculates the raw FPS based on the time
difference of the samples, and calculates the complexity score. This is moved from
Benchmark.processSamples.

(Controller): Initialize timestamps. These are at first relative to the start of the
benchmark, but are offset by the absolute start time during start(). By default maintain
3 data series, but subclasses can override.
(start): Calls recordFirstSample() for subclasses to override if needed.
(recordFirstSample): For basic controller, start sampling at the beginning.
(update): Update the frame length estimator and sample.
(shouldStop): Checks that the time is before _endTimestamp.
(results): Returns the processed samples.
(processSamples): Iterate through the sample data and collate them. Include scores.

(FixedComplexityController): Controller that tunes the stage to the desired complexity
prior to starting, and keeps it at that complexity.

(AdaptiveController): Have the estimator estimate the interval frame rate instead of the
raw frame rate.

The previous version of this controller ignored the frame that came after the

adjustment. The raw FPS show that whatever noise the scene change adds is negligible
compared to the noise of the system overall. Stop ignoring that frame and include all
frames in the measurements.

(Benchmark): Remove dependency on animator, and instantiate a runner based on what is
selected. Most of the loop's functionality is in Controller, so remove here.
(Benchmark.run): Remove start() since it is only called from run(), and fold it in here.
(Benchmark._animateLoop): Fold in from Animator.animateLoop. Let the benchmark run for
a brief period before calling Controller.start().

Animometer/tests/resources/math.js: Fix the Kalman estimator. The filter estimates

a scalar variable, and makes basic assumptions regarding the model. As a result
none of the linear algebra classes are needed, so remove Matrix, Vector3, and Matrix3.
(SimpleKalmanEstimator): Calculate the gain based on the provided process and
measurement errors.
(KalmanEstimator): Deleted.
(IdentityEstimator): Deleted.
(PIDController): Refactor to use the Utilities.createClass() helper.

The Kalman filter algorithm is explained here http://greg.czerniak.info/guides/kalman1/.
The state, represented by a scalar, is the estimated frame length. There is no user
transition of the state, and the state is the same as the measurement. With this model,
the estimation error converges, so calculate the gain ahead of time.

Animometer/developer.html: Remove fixed-after-warmup since it is not useful.

Replace the option to toggle the estimator, and make it possible to customize the
estimator's error parameters. Show raw FPS by default, and remove interval FPS,
which will be shown instead of the filtered raw FPS.

Animometer/resources/debug-runner/animometer.css: Put the header behind the graph.

Remove #intervalFPS rules; move the color to #filteredFPS.

Animometer/resources/debug-runner/graph.js:

(updateGraphData): Update the hr style to force the layout to be calculated
correctly. Change the tick format to be in terms of seconds, since the timestamps
are in milliseconds. Remove interval data.

Animometer/resources/runner/animometer.js:

(window.benchmarkController.startBenchmark): Set Kalman parameters.

Animometer/resources/runner/benchmark-runner.js:

(_runBenchmarkAndRecordResults): When a benchmark completes, expect it to return
the final data, rather than passing a sampler from the controller. This avoids
needing to expose the sampler variable in the benchmark.

Animometer/tests/resources/sampler.js:

(process): Move the setting of the target frame rate to AdaptiveController.

7:04 PM Changeset in webkit [196287] by n_wang@apple.com

5 edits
2 adds in trunk

AX: crash at WebCore::Range::selectNodeContents(WebCore::Node*, int&)
https://bugs.webkit.org/show_bug.cgi?id=154018

Reviewed by Chris Fleizach.

Source/WebCore:

Sometimes rangeForUnorderedCharacterOffsets call is accessing derefed node objects
and leading to a crash. Fixed it by checking isNodeInUse before creating the CharacterOffset
object.

Test: accessibility/text-marker/text-marker-range-stale-node-crash.html

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::visiblePositionForTextMarkerData):
(WebCore::AXObjectCache::characterOffsetForTextMarkerData):
(WebCore::AXObjectCache::traverseToOffsetInRange):

accessibility/AXObjectCache.h:
accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper rangeForTextMarkerRange:]):
(characterOffsetForTextMarker):
(-[WebAccessibilityObjectWrapper characterOffsetForTextMarker:]):
(textMarkerForVisiblePosition):

LayoutTests:

accessibility/text-marker/text-marker-range-stale-node-crash-expected.txt: Added.
accessibility/text-marker/text-marker-range-stale-node-crash.html: Added.

6:22 PM Changeset in webkit [196286] by akling@apple.com

7 edits in trunk/Source

[iOS] Throw away some unlinked code when navigating to a new page.
<https://webkit.org/b/154014>

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

runtime/VM.cpp:

(JSC::VM::deleteAllCodeExceptCaches):
(JSC::VM::deleteAllLinkedCode): Deleted.

runtime/VM.h:

Source/WebCore:

Extended the mechanism introduced earlier to also throw away unlinked code
that's only relevant to the page that we're navigating away from.

The new JSC::VM API is deleteAllCodeExceptCaches() and it does what it sounds
like, deleting unlinked and linked code but leaving code caches alone.

This means that if the page we're navigating to wants to parse some of the
same JS that the page we're leaving had on it, it might still be found in the
JSC::CodeCache.

Doing a back navigation to a PageCache'd page may now incur some reparsing,
just like leaving the app or tab would.

bindings/js/GCController.cpp:

(WebCore::GCController::deleteAllCodeExceptCaches):
(WebCore::GCController::deleteAllLinkedCode): Deleted.

bindings/js/GCController.h:
loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad):

5:55 PM Changeset in webkit [196285] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Search doesn't seem to find text that is present in multiple places
https://bugs.webkit.org/show_bug.cgi?id=154016
<rdar://problem/23391307>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Brian Burg.

UserInterface/Controllers/DebuggerManager.js:

(WebInspector.DebuggerManager.prototype.get searchableScripts):

UserInterface/Views/SearchSidebarPanel.js:

(WebInspector.SearchSidebarPanel.prototype.performSearch):
Only search scripts with a URL. Don't search the potentially
large number of anonymous scripts.

5:50 PM Changeset in webkit [196284] by commit-queue@webkit.org

4 edits
2 adds in trunk

Web Inspector: Zooming in on the timeline graph does not increase its time resolution from minutes
https://bugs.webkit.org/show_bug.cgi?id=154013
<rdar://problem/23844527>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Brian Burg.

Source/WebInspectorUI:

UserInterface/Base/Utilities.js:

(Number.secondsToString):
Simplify logic and ensure that when under high resolution we
don't go above seconds for our units.

(Number.bytesToString):
Simplify logic.

UserInterface/Views/LinearTimelineOverview.js:

(WebInspector.LinearTimelineOverview):
Reduce the rather large maximum seconds per pixel from 60 seconds
per pixel to 2 seconds per pixel. This means when the user zooms
out of a timeline they don't see such large time values.

LayoutTests:

inspector/unit-tests/number-utilities-expected.txt: Added.
inspector/unit-tests/number-utilities.html: Added.

Basic tests for our Number utilities methods.

5:26 PM Changeset in webkit [196283] by dbates@webkit.org

23 edits
30 adds in trunk

CSP connect-src directive should block redirects
https://bugs.webkit.org/show_bug.cgi?id=69359
<rdar://problem/24383025>

Reviewed by Brent Fulgham.

Source/WebCore:

Inspired by Blink patch:
<https://src.chromium.org/viewvc/blink?revision=150246&view=revision>

Apply the connect-src directive of the Content Security Policy for the document or worker to the redirect URL
of an XMLHttpRequest and EventSource load so as to conform to section Paths and Redirects of the CSP 2.0 spec.,
<https://w3c.github.io/webappsec-csp/2/#source-list-paths-and-redirects> (29 August 2015).

Additionally, check that each requested script URL passed to WorkerGlobalScope.importScripts() is allowed by
the CSP of the worker before initiating a load for it. If some URL i is blocked by the CSP policy
then we do not try to load URLs j >= i.

Tests: http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html

http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html
http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin.html
http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-allowed.html
http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked.html
http/tests/security/contentSecurityPolicy/worker-without-csp-importScripts-redirect-cross-origin-allowed.html
http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-redirect.html
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScripts-redirect-cross-origin.html
http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-redirect-cross-origin.html
http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr.html

fileapi/FileReaderLoader.cpp:

(WebCore::FileReaderLoader::start): Do not enforce a CSP directive as CSP is not applicable to File API.

inspector/InspectorNetworkAgent.cpp:

(WebCore::InspectorNetworkAgent::loadResource): Do not enforce a CSP directive as CSP should not interfere
with the Web Inspector.

loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::loadResourceSynchronously): Modified to take an optional ContentSecurityPolicy
and pass it through to DocumentThreadableLoader::create().
(WebCore::DocumentThreadableLoader::create): Modified to take an optional ContentSecurityPolicy and pass it through
to DocumentThreadableLoader::DocumentThreadableLoader().
(WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Modified to take an optional ContentSecurityPolicy.
Asserts that the CSP allows the load of the request URL so as to catch when a caller creates a loader for a request
that is not allowed by the CSP. The caller should not create a loader for such a request.
(WebCore::DocumentThreadableLoader::redirectReceived): Check if the CSP allows the redirect URL. If it does not
then notify the client that the redirect check failed.
(WebCore::DocumentThreadableLoader::loadRequest): Ditto.
(WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Checks that the specified URL is allowed
by the enforced CSP directive.
(WebCore::DocumentThreadableLoader::contentSecurityPolicy): Returns the ContentSecurityPolicy object passed to
DocumentThreadableLoader on instantiation or the ContentSecurityPolicy object of the associated document.

loader/DocumentThreadableLoader.h: Add overloaded variants of DocumentThreadableLoader::{create, loadResourceSynchronously}()

that take a std::unique_ptr<ContentSecurityPolicy>&&. Remove some unnecessary headers.

loader/ThreadableLoader.cpp:

(WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Take the CSP directive to enforce and store it.
(WebCore::ThreadableLoaderOptions::isolatedCopy): Copy the CSP directive to enforce.

loader/ThreadableLoader.h: Added member field to store the CSP directive to enforce (defaults to enforce the

directive connect-src - the most appropriate directive in most circumstances). As of the time of writing,
only WorkerGlobalScope.importScripts() enforces a different directive: script-src.

loader/WorkerThreadableLoader.cpp:

(WebCore::WorkerThreadableLoader::WorkerThreadableLoader): Pass the SecurityOrigin and ContentSecurityPolicy associated
with the WorkerGlobalScope to WorkerThreadableLoader::MainThreadBridge::MainThreadBridge().
(WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Pass a copy of the worker's ContentSecurityPolicy
to the DocumentThreadableLoader.

loader/WorkerThreadableLoader.h:
page/EventSource.cpp:

(WebCore::EventSource::connect): Enforce the CSP directive connect-src on redirects unless we are running in an isolated world.

workers/AbstractWorker.cpp:

(WebCore::AbstractWorker::resolveURL): Modified to take a boolean whether to bypass the main world Content Security Policy
instead of querying for it directly.

workers/AbstractWorker.h:
workers/Worker.cpp:

(WebCore::Worker::create): Added FIXME to enforce child-src directive of the document's CSP to the worker's script URL
on redirect once we fix <https://bugs.webkit.org/show_bug.cgi?id=153562>. For now, do not enforce a CSP policy on redirect
of the worker's script URL.

workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::importScripts): Check that the requested URL is allowed by the CSP of the worker (if applicable).
Enforce the CSP directive script-src on redirects unless we are running in an isolated world.

workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadSynchronously): Pass SecurityOrigin and ContentSecurityPolicyEnforcement to WorkerThreadableLoader.
(WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.

workers/WorkerScriptLoader.h:
xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::createRequest): Enforce the CSP directive connect-src on redirects unless we are running in
an isolated world.

LayoutTests:

Add more tests, update erroneous expected results, and remove some entries from TestExpectations for tests
that now pass.

TestExpectations: Remove entries for tests that now pass. The failure of test http/tests/security/contentSecurityPolicy/worker-importscripts-blocked.html

was erroneously attributed to <https://bugs.webkit.org/show_bug.cgi?id=153562>.

http/tests/security/contentSecurityPolicy/resources/determine-content-security-policy-header.php: Added.
http/tests/security/contentSecurityPolicy/resources/script-set-value.js: Use global variable self instead of window so as to

make this script work both from a Document and a Web Worker. In a document, self refers to the Window object and in a worker
it refers to the WorkerGlobalScope object.

http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-allowed.php: Added.
http/tests/security/contentSecurityPolicy/resources/worker-importScript-redirect-cross-origin-blocked.php: Added.
http/tests/security/contentSecurityPolicy/resources/worker-xhr-allowed.php: Added.
http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-allowed.php: Added.
http/tests/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-blocked.php: Added.
http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-expected.txt: Remove Blink-specific messages so that the test passes.
http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports-expected.txt: Added.
http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html: Added.
http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt: Added.
http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html: Added.
http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin-expected.txt: Added.
http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin.html: Added.
http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-allowed-expected.txt: Added.
http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-allowed.html: Added.
http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt: Added.
http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked.html: Added.
http/tests/security/contentSecurityPolicy/worker-importscripts-blocked-expected.txt: Substitute Blink-specific error text with the analogous WebKit error text.
http/tests/security/contentSecurityPolicy/worker-importscripts-blocked.html: Ditto.
http/tests/security/contentSecurityPolicy/worker-without-csp-importScripts-redirect-cross-origin-allowed-expected.txt: Added.
http/tests/security/contentSecurityPolicy/worker-without-csp-importScripts-redirect-cross-origin-allowed.html: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-redirect-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-redirect.html: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScripts-redirect-cross-origin-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScript-redirect-cross-origin-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScripts-redirect-cross-origin-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScripts-redirect-cross-origin.html: Added.
http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-redirect-cross-origin-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-redirect-cross-origin.html: Added.
http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr.html: Added.

5:25 PM Changeset in webkit [196282] by Antti Koivisto

2 edits in trunk/Source/WebCore

Try to fix Yosemite build.

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::ComposedTreeIterator):
(WebCore::ComposedTreeIterator::traverseNext):

5:15 PM Changeset in webkit [196281] by Antti Koivisto

5 edits
1 add in trunk/Source/WebCore

Implement ComposedTreeIterator in terms of ElementAndTextDescendantIterator
https://bugs.webkit.org/show_bug.cgi?id=154003

Reviewed by Darin Adler.

Currently ComposedTreeIterator implements tree traversal using NodeTraversal. This makes it overly complicated.
It can also return nodes other than Element and Text which should not be part of the composed tree.

This patch adds a new iterator type, ElementAndTextDescendantIterator, similar to the existing ElementDescendantIterator.
ComposedTreeIterator is then implemented using this new iterator.

When entering a shadow tree or a slot the local iterator is pushed along with the context stack and a new local
iterator is initialized for the new context. When leaving a shadow tree the context stack is popped and the previous
local iterator becomes active.

WebCore.xcodeproj/project.pbxproj:
dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::ComposedTreeIterator):
(WebCore::ComposedTreeIterator::initializeContextStack):
(WebCore::ComposedTreeIterator::pushContext):
(WebCore::ComposedTreeIterator::traverseNextInShadowTree):
(WebCore::ComposedTreeIterator::traverseNextLeavingContext):
(WebCore::ComposedTreeIterator::advanceInSlot):
(WebCore::ComposedTreeIterator::traverseSiblingInSlot):
(WebCore::ComposedTreeIterator::initializeShadowStack): Deleted.
(WebCore::ComposedTreeIterator::traverseParentInShadowTree): Deleted.
(WebCore::ComposedTreeIterator::traverseNextSiblingSlot): Deleted.
(WebCore::ComposedTreeIterator::traversePreviousSiblingSlot): Deleted.

dom/ComposedTreeIterator.h:

(WebCore::ComposedTreeIterator::operator*):
(WebCore::ComposedTreeIterator::operator->):
(WebCore::ComposedTreeIterator::operator==):
(WebCore::ComposedTreeIterator::operator!=):
(WebCore::ComposedTreeIterator::operator++):
(WebCore::ComposedTreeIterator::Context::Context):
(WebCore::ComposedTreeIterator::context):
(WebCore::ComposedTreeIterator::current):
(WebCore::ComposedTreeIterator::ComposedTreeIterator):
(WebCore::ComposedTreeIterator::traverseNext):
(WebCore::ComposedTreeIterator::traverseNextSkippingChildren):
(WebCore::ComposedTreeIterator::traverseNextSibling):
(WebCore::ComposedTreeIterator::traversePreviousSibling):
(WebCore::ComposedTreeDescendantAdapter::ComposedTreeDescendantAdapter):
(WebCore::ComposedTreeDescendantAdapter::begin):
(WebCore::ComposedTreeDescendantAdapter::end):
(WebCore::ComposedTreeDescendantAdapter::at):
(WebCore::ComposedTreeChildAdapter::Iterator::Iterator):
(WebCore::ComposedTreeChildAdapter::ComposedTreeChildAdapter):
(WebCore::ComposedTreeChildAdapter::begin):
(WebCore::ComposedTreeChildAdapter::end):
(WebCore::ComposedTreeChildAdapter::at):
(WebCore::ComposedTreeIterator::ShadowContext::ShadowContext): Deleted.
(WebCore::ComposedTreeIterator::traverseParent): Deleted.

dom/ElementAndTextDescendantIterator.h: Added.

New iterator type that traverses Element and Text nodes (that is renderable nodes only).
It also tracks depth for future use.

5:06 PM Changeset in webkit [196280] by fpizlo@apple.com

3 edits in trunk/Source/JavaScriptCore

B3::foldPathConstants() needs to execute its insertion set
https://bugs.webkit.org/show_bug.cgi?id=154020

Reviewed by Saam Barati.

b3/B3FoldPathConstants.cpp:
b3/testb3.cpp:

(JSC::B3::testFoldPathEqual): Added this. It used to crash in validation.
(JSC::B3::run):

3:29 PM Changeset in webkit [196279] by bshafiei@apple.com

1 copy in tags/Safari-601.3.9.1.3

New tag.

3:18 PM Changeset in webkit [196278] by bshafiei@apple.com

20 edits
2 copies in branches/safari-601-branch

Merged r187245. rdar://problem/19861992

3:15 PM Changeset in webkit [196277] by bshafiei@apple.com

20 edits
2 copies in branches/safari-601.3.9.1-branch

Merged r187245. rdar://problem/19861992

3:14 PM Changeset in webkit [196276] by Yusuke Suzuki

5 edits in trunk/Source/JavaScriptCore

[JSC] Introduce @isObject bytecode intrinsic and use it instead of JS implemented one
https://bugs.webkit.org/show_bug.cgi?id=153976

Reviewed by Darin Adler.

Use bytecode op_is_object directly.

builtins/GlobalObject.js:

(isObject): Deleted.

bytecode/BytecodeIntrinsicRegistry.h:
bytecompiler/NodesCodegen.cpp:

(JSC::BytecodeIntrinsicNode::emit_intrinsic_toString):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_isObject):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init): Deleted.

3:13 PM Changeset in webkit [196275] by commit-queue@webkit.org

22 edits in trunk/Source/WebInspectorUI

Web Inspector: Extract a few common unicode characters into global variables
https://bugs.webkit.org/show_bug.cgi?id=154008

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Timothy Hatcher.

UserInterface/Base/Utilities.js:

Create global variables for emDash and ellipsis to use all over the tools.

UserInterface/Views/ConsoleMessageView.js:

(WebInspector.ConsoleMessageView.prototype._formatParameterAsTable): Deleted.

UserInterface/Views/DefaultDashboardView.js:

(WebInspector.DefaultDashboardView.prototype._updateDisplay):

UserInterface/Views/HierarchicalPathComponent.js:

(WebInspector.HierarchicalPathComponent.prototype._updateElementTitleAndText):
(WebInspector.HierarchicalPathComponent.prototype._updateSelectElement.createOption):
(WebInspector.HierarchicalPathComponent.prototype._updateSelectElement):

UserInterface/Views/HierarchicalPathNavigationItem.js:

(WebInspector.HierarchicalPathNavigationItem.prototype.updateLayout):

UserInterface/Views/LayerTreeDataGridNode.js:

(WebInspector.LayerTreeDataGridNode.prototype.set layer):

UserInterface/Views/LayoutTimelineDataGridNode.js:

(WebInspector.LayoutTimelineDataGridNode.prototype.createCellContent):
(WebInspector.LayoutTimelineDataGridNode):

UserInterface/Views/MemoryCategoryView.js:

(WebInspector.MemoryCategoryView.prototype._updateDetails): Deleted.
(WebInspector.MemoryCategoryView): Deleted.

UserInterface/Views/MemoryTimelineView.js:

(WebInspector.MemoryTimelineView.prototype._clearUsageLegend):
(WebInspector.MemoryTimelineView.prototype._updateUsageLegend):
(WebInspector.MemoryTimelineView.prototype._clearMaxComparisonLegend):
(WebInspector.MemoryTimelineView.prototype._updateMaxComparisonLegend):

UserInterface/Views/MultipleScopeBarItem.js:

(WebInspector.MultipleScopeBarItem.set scopeBarItems.createOption):
(WebInspector.MultipleScopeBarItem.prototype.set scopeBarItems):

UserInterface/Views/ObjectPreviewView.js:

(WebInspector.ObjectPreviewView.prototype._appendEntryPreviews):
(WebInspector.ObjectPreviewView.prototype._appendPropertyPreviews):

UserInterface/Views/ProfileNodeDataGridNode.js:

(WebInspector.ProfileNodeDataGridNode.prototype.createCellContent):
(WebInspector.ProfileNodeDataGridNode):

UserInterface/Views/RenderingFrameTimelineDataGridNode.js:

(WebInspector.RenderingFrameTimelineDataGridNode.prototype.createCellContent):
(WebInspector.RenderingFrameTimelineDataGridNode):

UserInterface/Views/ResourceDetailsSidebarPanel.js:

(WebInspector.ResourceDetailsSidebarPanel.prototype._refreshRequestAndResponse): Deleted.
(WebInspector.ResourceDetailsSidebarPanel.prototype._valueForSize): Deleted.

UserInterface/Views/ResourceTimelineDataGridNode.js:

(WebInspector.ResourceTimelineDataGridNode.prototype.createCellContent):

UserInterface/Views/ScriptTimelineDataGridNode.js:

(WebInspector.ScriptTimelineDataGridNode.prototype.createCellContent):
(WebInspector.ScriptTimelineDataGridNode):

UserInterface/Views/SearchResultTreeElement.js:

(WebInspector.SearchResultTreeElement.truncateAndHighlightTitle):

UserInterface/Views/TimelineDataGridNode.js:

(WebInspector.TimelineDataGridNode.prototype.createCellContent):

UserInterface/Views/TypeTreeElement.js:

(WebInspector.TypeTreeElement.prototype.onpopulate):

UserInterface/Views/TypeTreeView.js:

(WebInspector.TypeTreeView.prototype._populate):
(WebInspector.TypeTreeView):

3:12 PM Changeset in webkit [196274] by Yusuke Suzuki

6 edits in trunk

{Map,Set}.prototype.forEach should be visible as own properties
https://bugs.webkit.org/show_bug.cgi?id=153974

Reviewed by Darin Adler.

Source/JavaScriptCore:

Now, Map and Set uses builtin tables. We should inlude it in class info.

runtime/MapPrototype.cpp:
runtime/SetPrototype.cpp:

LayoutTests:

js/Object-getOwnPropertyNames-expected.txt:
js/script-tests/Object-getOwnPropertyNames.js:

3:00 PM Changeset in webkit [196273] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Baseline JIT should not require its input to be constant-propagated
https://bugs.webkit.org/show_bug.cgi?id=154011
rdar://problem/24290933

Reviewed by Mark Lam.

jit/JITArithmetic.cpp:

(JSC::JIT::emitBitBinaryOpFastPath):
(JSC::JIT::emitRightShiftFastPath):
(JSC::JIT::emit_op_add):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):

2:31 PM Changeset in webkit [196272] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

CodeCache should give up on evals if there are variables under TDZ
https://bugs.webkit.org/show_bug.cgi?id=154002
rdar://problem/24300998

Reviewed by Mark Lam.

Disable the code cache optimization because our approach to TDZ for scoped variables - using
a separate check_tdz opcode when logically it's the get_from_scope's job to do it - makes
caching code impossible if there are any variables in TDZ.

We should do the right thing in the future, and fold the TDZ check into the get_from_scope.
This is better not only because it will restore caching, but because our bytecode for heap
accesses is usually at the highest practically doable level of abstraction, so that ICs,
compilers and caches can see the intended meaning of the bytecode more easily.

This doesn't appear to slow anything down, but that's just because we don't have enough ES6
benchmarks. I've filed: https://bugs.webkit.org/show_bug.cgi?id=154010

runtime/CodeCache.cpp:

(JSC::CodeCache::getGlobalCodeBlock):

2:07 PM Changeset in webkit [196271] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: ⇧⌘→ when editing text in the Elements tree shouldn't switch inspector tab
https://bugs.webkit.org/show_bug.cgi?id=154006
<rdar://problem/22892489>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Timothy Hatcher.

UserInterface/Views/EditingSupport.js:

(WebInspector.isEventTargetAnEditableField):
Check the WebInspector's custom editing state.

1:50 PM Changeset in webkit [196270] by commit-queue@webkit.org

4 edits
2 adds in trunk

Web Inspector: copy({x:1}) should copy "{x:1}", not "[object Object]"
https://bugs.webkit.org/show_bug.cgi?id=148605

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-08
Reviewed by Brian Burg.

Source/WebCore:

Test: inspector/console/command-line-api-copy.html

inspector/CommandLineAPIModuleSource.js:

(CommandLineAPIImpl.prototype.copy):
Support copying different types. This is meant to be more
convenient then just JSON.stringify, so it handles types
like Node, Symbol, RegExp, and Function a bit better.

LayoutTests:

inspector/console/command-line-api-copy-expected.txt: Added.
inspector/console/command-line-api-copy.html: Added.
http/tests/inspector/console/cross-domain-inspected-node-access-expected.txt:

1:47 PM Changeset in webkit [196269] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark fast/text/crash-complex-text-surrogate.html as flaky on mac-wk2
https://bugs.webkit.org/show_bug.cgi?id=154005

Unreviewed test gardening.

platform/mac-wk2/TestExpectations:

12:54 PM Changeset in webkit [196268] by commit-queue@webkit.org

19 edits
2 adds in trunk

REGRESSION(r181345): SVG polyline and polygon leak page
https://bugs.webkit.org/show_bug.cgi?id=152759

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-02-08
Reviewed by Darin Adler.

Source/WebCore:

The leak happens because of cyclic reference between SVGListPropertyTearOff
and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
There is also cyclic reference between SVGAnimatedProperty and SVGElement
and this causes the whole document to be leaked. So if the JS requests, for
example, an instance of SVGPolylineElement.points, the whole document will be
leaked.

The fix depends on having the cyclic reference as is since the owning and the
owned classes have to live together if any of them is referenced. But the owning
class caches a raw 'ref-counted' pointer of the owned class. If it is requested
for an instance of the owned class it returned a RefPtr<> of it. Once the owned
class is not used, it can delete itself. The only thing needed here is to notify
the owner class of the deletion so it cleans its caches and be able to create a
new pointer if it is requested for an instance of the owned class later.

Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
to break the cyclic reference between SVGElement and SVGAnimatedProperty.

Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
animVal() to break cyclic reference between SVGListPropertyTearOff and
SVGAnimatedListPropertyTearOff.

Test: svg/animations/smil-leak-list-property-instances.svg

bindings/scripts/CodeGeneratorJS.pm:

(NativeToJSValue): The SVG non-string list tear-off properties became of
type RefPtr<>. So we need to use get() with the casting expressions.

svg/SVGMarkerElement.cpp:

(WebCore::SVGMarkerElement::orientType):
Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().

svg/SVGPathElement.cpp:

(WebCore::SVGPathElement::pathByteStream):
(WebCore::SVGPathElement::lookupOrCreateDWrapper):
Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to
use get() for the casting expressions.

(WebCore::SVGPathElement::pathSegList):
(WebCore::SVGPathElement::normalizedPathSegList):
(WebCore::SVGPathElement::animatedPathSegList):
(WebCore::SVGPathElement::animatedNormalizedPathSegList):

svg/SVGPathElement.h:

Change the return value from raw pointer to RefPtr<>.

svg/SVGPathSegWithContext.h:

(WebCore::SVGPathSegWithContext::animatedProperty):
Change the return type to be RefPtr<> to preserve the value from being deleted.

svg/SVGPolyElement.cpp:

(WebCore::SVGPolyElement::parseAttribute):
Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
use get() for the casting expressions.

(WebCore::SVGPolyElement::points):
(WebCore::SVGPolyElement::animatedPoints):

svg/SVGPolyElement.h:

Change the return value from raw pointer to RefPtr<>.

svg/SVGViewSpec.cpp:

(WebCore::SVGViewSpec::setTransformString):
Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to
use get() for the casting expressions.

(WebCore::SVGViewSpec::transform):

svg/SVGViewSpec.h:

Change the return value from raw pointer to RefPtr<>.

svg/properties/SVGAnimatedListPropertyTearOff.h:

(WebCore::SVGAnimatedListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedListPropertyTearOff::animVal):
Change the return value from raw pointer to RefPtr<> and change the cached
value from RefPtr<> to raw pointer. If the property is null, it will be
created, its raw pointer will be cached and the only ref-counted RefPtr<>
will be returned. This will guarantee, the RefPtr<> will be deleted once
it is not used anymore.

(WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
actual pointer. This function will be called from the destructor of
SVGListPropertyTearOff.

(WebCore::SVGAnimatedListPropertyTearOff::findItem):
(WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
We have to ensure the baseVal() is created before using it.

(WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
(WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
(WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
to the animVal(). This will prevent deleting m_animVal while animation.

svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:

(WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
Same as what is done in SVGAnimatedListPropertyTearOff.

(WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
(WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
Same as what is done in SVGAnimatedListPropertyTearOff.

svg/properties/SVGAnimatedProperty.h:

(WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
Change the return value from raw reference to Ref<> and change the
cached value from Ref<> to raw pointer. This reverts the change of
r181345 in this function.

(WebCore::SVGAnimatedProperty::lookupWrapper):
Change the return value from raw pointer to RefPtr<>.

svg/properties/SVGAnimatedPropertyMacros.h:

Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().

svg/properties/SVGAnimatedTransformListPropertyTearOff.h:

(WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
(WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
Same as what is done in SVGAnimatedListPropertyTearOff.

svg/properties/SVGListPropertyTearOff.h:

(WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
its raw pointers when the RefPtr<> deletes itself.

LayoutTests:

TestExpectations: Remove flaky tests from test expectation.

svg/animations/smil-leak-list-property-instances-expected.txt: Added.
svg/animations/smil-leak-list-property-instances.svg: Added.

Ensure if SVGPolylineElement.points is requested from JS, the document will
not leak.

12:53 PM Changeset in webkit [196267] by andersca@apple.com

2 edits in trunk/Source/WebKit/mac

Crash when trying to chain to the old -[NSView setNeedsDisplayInRect:]
https://bugs.webkit.org/show_bug.cgi?id=154001
rdar://problem/24519975

Reviewed by Dan Bernstein.

If our replaced -[NSView setNeedsDisplayInRect:] is called before the old IMP has been initialized,
we can end up trying to call a null pointer.

Fix this by using method_exchangeImplementations instead of method_setImplementation, since the former is done
atomically.

WebView/WebHTMLView.mm:

(-[NSView _web_setNeedsDisplayInRect:]):
(+[WebHTMLViewPrivate initialize]):
(setNeedsDisplayInRect): Deleted.

11:49 AM Changeset in webkit [196266] by commit-queue@webkit.org

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Long values for comma separated CSS properties overflow the Visual sidebar area
https://bugs.webkit.org/show_bug.cgi?id=153890
<rdar://problem/24510216>

Patch by Devin Rousso <Devin Rousso> on 2016-02-08
Reviewed by Timothy Hatcher.

For especially long values in comma-separated CSS properties (such as
background-image), the text will not be clipped as expected due to the
way in which the width is calculated for the element (the value, inside
the title element, is the only child with a specified width other than
100%). This overflowing causes the width of the section containing that
property to expand, pushing content outside of the inspector window. To
remedy this, a specified width is set on the relevant properties based
on the width of the sidebar to ensure proper text clipping.

UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.css:

(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list > .visual-style-comma-separated-keyword-item.visual-style-font-family-list-item > .visual-style-comma-separated-keyword-item-editor):
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list > .visual-style-comma-separated-keyword-item > .titles):
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list > .visual-style-comma-separated-keyword-item > .titles > .subtitle):
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container): Deleted.
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list): Deleted.
(.visual-style-property-container.comma-separated-keyword-editor > .visual-style-property-value-container > .visual-style-comma-separated-keyword-list > .visual-style-comma-separated-keyword-item): Deleted.

UserInterface/Views/VisualStyleCommaSeparatedKeywordEditor.js:

(WebInspector.VisualStyleCommaSeparatedKeywordEditor.prototype.set specifiedWidth):
Calculates the necessary subtractions from the given width value based on
the margins and size of sibling elements.

UserInterface/Views/VisualStyleDetailsPanel.js:

(WebInspector.VisualStyleDetailsPanel.prototype._updateProperties):
(WebInspector.VisualStyleDetailsPanel.prototype._populateFontSection):
(WebInspector.VisualStyleDetailsPanel.prototype._populateBackgroundStyleSection):
(WebInspector.VisualStyleDetailsPanel.prototype._populateBoxShadowSection):
(WebInspector.VisualStyleDetailsPanel.prototype._populateTransitionSection):
Added another list to each group which, if set, will pass the current
sidebar width to all contained property editors.

UserInterface/Views/VisualStylePropertyEditor.js:

(WebInspector.VisualStylePropertyEditor.prototype.update):
Somewhat unrelated (r196146), but added another check to ensure that the
CSS property exists before checking to see if it has an invalid value.

11:42 AM Changeset in webkit [196265] by Carlos Garcia Campos

5 edits in trunk/Source

[GTK] WebKitWebView should send crossing events to the WebProcess
https://bugs.webkit.org/show_bug.cgi?id=153740

Reviewed by Michael Catanzaro.

Source/WebCore:

page/EventHandler.cpp:

(WebCore::EventHandler::handleMouseMoveEvent): Call
updateMouseEventTargetNode() before early returning in case of
only updating scrollbars.

Source/WebKit2:

We don't currently handle crossing events in the web view
(enter/leave). That's why if you hover a scrollbar and leave the
window, the scrollbar is still rendered as hovered.

Shared/gtk/WebEventFactory.cpp:

(WebKit::buttonForEvent): Handle the case of GDK_ENTER_NOTIFY and
GDK_LEAVE_NOTIFY events.
(WebKit::WebEventFactory::createWebMouseEvent): Ditto.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

11:41 AM Changeset in webkit [196264] by Carlos Garcia Campos

2 edits in trunk/Source/WebKit2

Infinite loop when processing mouse events synchronously
https://bugs.webkit.org/show_bug.cgi?id=153995

Reviewed by Darin Adler.

This happened with WTR in the GTK+ port after landing patch in bug
#153740. The thing is that WTR forces events handling IPC messages
to be synchronous. When a drag and drop operation is in progress,
the web process ignores mouse move events and replies with
DidReceiveEvent signal. The DidReceiveEvent message handler in
WebPageProxy checks if we have a m_nextMouseMoveEvent and handles
it, but when all this happens synchronously the
m_nextMouseMoveEvent is the current one because we haven't
returned yet from handleMouseEvent(). We need to invalidate the
m_nextMouseMoveEvent before calling handleMouseEvent().

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didReceiveEvent):

11:33 AM Changeset in webkit [196263] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

PiP and external playback are mutually exclusive.
https://bugs.webkit.org/show_bug.cgi?id=153988
rdar://problem/24108661

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-02-08
Reviewed by Eric Carlson.

Adding isPlayingOnSecondScreen to isPlayingOnExternalScreen allows AVKit to disable PiP
when appropriate. Testing video fullscreen mode in updateDisableExternalPlayback allows us to
turn-off external playback when entering picture-in-picture.

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenMode):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateDisableExternalPlayback):

platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(-[WebAVPlayerController isPlayingOnExternalScreen]):
(+[WebAVPlayerController keyPathsForValuesAffectingPlayingOnExternalScreen]):

11:31 AM Changeset in webkit [196262] by beidson@apple.com

4 edits in trunk/LayoutTests

IndexedDB: No test covers cursor.delete() setting the source of the request to the cursor.
https://bugs.webkit.org/show_bug.cgi?id=153992

Reviewed by Jer Noble.

storage/indexeddb/cursor-delete-expected.txt:
storage/indexeddb/cursor-delete-private-expected.txt:
storage/indexeddb/resources/cursor-delete.js:

11:29 AM Changeset in webkit [196261] by commit-queue@webkit.org

10 edits in trunk

[ES6] Arrow function syntax. Using 'super' in arrow function that declared out of the class should lead to Syntax error
https://bugs.webkit.org/show_bug.cgi?id=150893

Patch by Skachkov Oleksandr <gskachkov@gmail.com> on 2016-02-08
Reviewed by Saam Barati.
Source/JavaScriptCore:

'super' and 'super()' inside of the arrow function should lead to syntax error if they are used
out of the class context or they wrapped by ordinary function. Now JSC returns ReferenceError but
should return SyntaxError according to the following specs:
http://www.ecma-international.org/ecma-262/6.0/#sec-function-definitions-static-semantics-early-errors
and http://www.ecma-international.org/ecma-262/6.0/#sec-arrow-function-definitions-runtime-semantics-evaluation
Curren patch implemented only one case when super/super() are used inside of the arrow function
Case when super/super() are used within the eval:

class A {}
class B extends A {

costructor() { eval("super()");}

}

is not part of this patch and will be implemented in this issue https://bugs.webkit.org/show_bug.cgi?id=153864.
The same for case when eval with super/super() is invoked in arrow function will be
implemented in issue https://bugs.webkit.org/show_bug.cgi?id=153977.

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseFunctionInfo):

parser/Parser.h:

(JSC::Scope::Scope):
(JSC::Scope::setExpectedSuperBinding):
(JSC::Scope::expectedSuperBinding):
(JSC::Scope::setConstructorKind):
(JSC::Scope::constructorKind):
(JSC::Parser::closestParentNonArrowFunctionNonLexicalScope):

tests/stress/arrowfunction-lexical-bind-supercall-4.js:
tests/stress/arrowfunction-lexical-bind-superproperty.js:

LayoutTests:

Adding tests for using of the 'super' inside of the arrow function

js/arrowfunction-superproperty-expected.txt:
js/arrowfunction-syntax-errors-expected.txt:
js/script-tests/arrowfunction-superproperty.js:
js/script-tests/arrowfunction-syntax-errors.js:

11:27 AM Changeset in webkit [196260] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit2

Remove weak from WKAirPlayRoutePicker.mm to fix build warning.
https://bugs.webkit.org/show_bug.cgi?id=153985
rdar://problem/24485348

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-02-08
Reviewed by Darin Adler.

Remove weak since it is only available when using ARC.

UIProcess/ios/forms/WKAirPlayRoutePicker.mm:

10:58 AM Changeset in webkit [196259] by fpizlo@apple.com

4 edits in trunk/Source/WTF

Make sure that locking code that relies on module boundaries for compiler fences uses NEVER_INLINE
https://bugs.webkit.org/show_bug.cgi?id=153972

Reviewed by Andreas Kling.

When this code was written, we assumed that module boundaries were compiler fences. That might
not be the case if we ever do LTO.

wtf/Lock.cpp:

(WTF::LockBase::lockSlow):
(WTF::LockBase::unlockSlow):

wtf/ParkingLot.cpp:

(WTF::ParkingLot::parkConditionally):
(WTF::ParkingLot::unparkOne):
(WTF::ParkingLot::unparkAll):
(WTF::ParkingLot::forEach):

wtf/WordLock.cpp:

(WTF::WordLock::lockSlow):
(WTF::WordLock::unlockSlow):

10:52 AM Changeset in webkit [196258] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Parser should detect error before calls to parseAssignmentExpression()
https://bugs.webkit.org/show_bug.cgi?id=153975
rdar://problem/24291231

Reviewed by Saam Barati.

Fixes a very hard-to-create situation that an internal test picked up.

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseVariableDeclarationList):
(JSC::Parser<LexerType>::parseAssignmentExpression):

10:43 AM Changeset in webkit [196257] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit2

[GTK] Fix crash when creating webview with g_object_new
https://bugs.webkit.org/show_bug.cgi?id=153989

Patch by Danilo Cesar Lemes de Paula <danilo.cesar@collabora.co.uk> on 2016-02-08
Reviewed by Carlos Garcia Campos.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkit_web_view_base_class_init):

10:28 AM Changeset in webkit [196256] by commit-queue@webkit.org

5 edits in trunk/Source

Unreviewed, rolling out r196253.
https://bugs.webkit.org/show_bug.cgi?id=153990

Caused several crashes in GTK+ bots (Requested by KaL on
#webkit).

Reverted changeset:

"[GTK] WebKitWebView should send crossing events to the
WebProcess"
https://bugs.webkit.org/show_bug.cgi?id=153740
http://trac.webkit.org/changeset/196253

10:23 AM Changeset in webkit [196255] by Matt Baker

2 edits in trunk/Source/WebInspectorUI

Web Inspector: WebInspector.Setting should have a "reset" method
https://bugs.webkit.org/show_bug.cgi?id=153971
<rdar://problem/24544101>

Reviewed by Brian Burg.

Currently UI needing to restore a setting to its default must retain a copy
of the default value. This should be a basic operation of WebInspector.Setting.

UserInterface/Base/Setting.js:

(WebInspector.Setting):
(WebInspector.Setting.prototype.reset):
Sets value to a copy of the default.

9:06 AM Changeset in webkit [196254] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

WebAVPlayerController should implement currentTimeWithinEndTimes.
https://bugs.webkit.org/show_bug.cgi?id=153983
rdar://problem/22864621

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-02-08
Reviewed by Eric Carlson.

Implement currentTimeWithinEndTimes in terms of seekToTime and AVTiming. This is a trivial
implementation becuase AVPlayer start and end times aren't used.

platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(-[WebAVPlayerController currentTimeWithinEndTimes]):
(-[WebAVPlayerController setCurrentTimeWithinEndTimes:]):
(+[WebAVPlayerController keyPathsForValuesAffectingCurrentTimeWithinEndTimes]):

8:59 AM Changeset in webkit [196253] by Carlos Garcia Campos

5 edits in trunk/Source

[GTK] WebKitWebView should send crossing events to the WebProcess
https://bugs.webkit.org/show_bug.cgi?id=153740

Reviewed by Michael Catanzaro.

Source/WebCore:

page/EventHandler.cpp:

(WebCore::EventHandler::handleMouseMoveEvent): Call
updateMouseEventTargetNode() before early returning in case of
only updating scrollbars.

Source/WebKit2:

We don't currently handle crossing events in the web view
(enter/leave). That's why if you hover a scrollbar and leave the
window, the scrollbar is still rendered as hovered.

Shared/gtk/WebEventFactory.cpp:

(WebKit::buttonForEvent): Handle the case of GDK_ENTER_NOTIFY and
GDK_LEAVE_NOTIFY events.
(WebKit::WebEventFactory::createWebMouseEvent): Ditto.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

8:46 AM Changeset in webkit [196252] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

WebVideoFullscreenInterface should handle video resizing.
https://bugs.webkit.org/show_bug.cgi?id=153982
rdar://problem/22031249

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-02-08
Reviewed by Eric Carlson.

Video fullscreen can be initiated before video dimension are available.
Protect against an initial width or height of zero and observe resize events
to update once video dimensions become available or change.

platform/cocoa/WebVideoFullscreenModelVideoElement.mm:

(WebVideoFullscreenModelVideoElement::updateForEventName):
(WebVideoFullscreenModelVideoElement::observedEventNames):

platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(-[WebAVPlayerLayer layoutSublayers]):
(-[WebAVPlayerLayer videoRect]):
(WebVideoFullscreenInterfaceAVKit::setVideoDimensions):

8:25 AM Changeset in webkit [196251] by akling@apple.com

3 edits in trunk/Source/JavaScriptCore

Visiting a WeakBlock should report bytes visited, since we reported them allocated.
<https://webkit.org/b/153978>

Reviewed by Darin Adler.

When creating a WeakBlock, we tell Heap that we've allocated 1 KB (WeakBlock::blockSize)
of memory. Consequently, when visiting a WeakBlock, we should also report 1 KB of memory
visited. Otherwise Heap will think that those 1 KB already went away.

This was causing us to underestimate heap size, which affects collection scheduling.

heap/SlotVisitor.h:

(JSC::SlotVisitor::reportMemoryVisited):

heap/WeakBlock.cpp:

(JSC::WeakBlock::visit):

5:43 AM Changeset in webkit [196250] by commit-queue@webkit.org

2 edits in trunk/LayoutTests

Timeouts in tests because of non implemented UIScriptController::singleTapAtPoint()
https://bugs.webkit.org/show_bug.cgi?id=153833

Unreviewed.

Patch by Adrien Plazas <aplazas@igalia.com> on 2016-02-08

platform/gtk/TestExpectations:

5:41 AM Changeset in webkit [196249] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Indent inline box test fails due to assertion in VisibleSelection::selectionFromContentsOfNode()
https://bugs.webkit.org/show_bug.cgi?id=153824

Patch by Adrien Plazas <aplazas@igalia.com> on 2016-02-08
Reviewed by Michael Catanzaro.

editing/markup.cpp:

(WebCore::highestAncestorToWrapMarkup):

Feb 7, 2016:

7:22 PM Changeset in webkit [196248] by weinig@apple.com

2 edits in trunk/Source/WebCore

Remove unused enum ScrollbarOverlayState.

Rubber-stamped by Dan Bernstein.

platform/ScrollTypes.h:

7:20 PM Changeset in webkit [196247] by weinig@apple.com

3 edits in trunk/Source/WebCore

Remove unnecessary respondsToSelector checks for methods that exist on all supported platforms
https://bugs.webkit.org/show_bug.cgi?id=153970

Reviewed by Dan Bernstein.

-[NSScrollerImp mouseEnteredScroller], -[NSScrollerImp expansionTransitionProgress],
-[NSScrollerImpPair contentAreaScrolledInDirection:], and -[NSScrollerImp setExpanded:]
are now available on all supported OS's. No need to check for them.

platform/mac/ScrollAnimatorMac.mm:

(macScrollbarTheme):
(-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
(WebCore::ScrollAnimatorMac::mouseEnteredScrollbar):
(WebCore::ScrollAnimatorMac::mouseExitedScrollbar):
(WebCore::ScrollAnimatorMac::sendContentAreaScrolled):
(WebCore::ScrollAnimatorMac::sendContentAreaScrolledTimerFired):
(supportsUIStateTransitionProgress): Deleted.
(supportsExpansionTransitionProgress): Deleted.
(supportsContentAreaScrolledInDirection): Deleted.

platform/mac/ScrollbarThemeMac.mm:

(+[WebScrollbarPrefsObserver appearancePrefsChanged:]):
(+[WebScrollbarPrefsObserver behaviorPrefsChanged:]):
(WebCore::ScrollbarThemeMac::scrollbarThickness):

7:01 PM Changeset in webkit [196246] by weinig@apple.com

8 edits
1 add in trunk/Source/WebCore

Use modern SPI header idiom for NSScrollerImp and NSScrollerImpPair
https://bugs.webkit.org/show_bug.cgi?id=153969

Reviewed by Dan Bernstein.

WebCore.xcodeproj/project.pbxproj:

Add new file NSScrollerImpSPI.h

page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:

Use new include of NSScrollerImpSPI.h.

platform/ScrollbarThemeComposite.h:

Define ScrollbarPainter more precisely as NSScrollerImp * now that the type is available to us.

platform/mac/NSScrollerImpDetails.h:

Remove NSObject category based SPI usage with the modern one NSScrollerImpSPI.h

platform/mac/NSScrollerImpDetails.mm:

(WebCore::recommendedScrollerStyle):
Simplify recommendedScrollerStyle() now that all OS's we ship on have +[NSScroller preferredScrollerStyle].

platform/mac/ScrollAnimatorMac.mm:

(supportsUIStateTransitionProgress):
(supportsExpansionTransitionProgress):
(supportsContentAreaScrolledInDirection):
Stop using NSClassFromString now that we can reference the classes explicitly.

(-[WebScrollbarPainterControllerDelegate invalidate]):
(-[WebScrollbarPainterControllerDelegate contentAreaRectForScrollerImpPair:]):
(-[WebScrollbarPainterControllerDelegate inLiveResizeForScrollerImpPair:]):
(-[WebScrollbarPainterControllerDelegate mouseLocationInContentAreaForScrollerImpPair:]):
(-[WebScrollbarPainterControllerDelegate scrollerImpPair:convertContentPoint:toScrollerImp:]):
(-[WebScrollbarPainterControllerDelegate scrollerImpPair:setContentAreaNeedsDisplayInRect:]):
(-[WebScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:]):
(-[WebScrollbarPainterDelegate layer]):
(-[WebScrollbarPainterDelegate mouseLocationInScrollerForScrollerImp:]):
(-[WebScrollbarPainterDelegate convertRectToLayer:]):
(-[WebScrollbarPainterDelegate shouldUseLayerPerPartForScrollerImp:]):
(-[WebScrollbarPainterDelegate setUpAlphaAnimation:scrollerPainter:part:animateAlphaTo:duration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
(-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
(-[WebScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
(WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
(WebCore::ScrollAnimatorMac::lockOverlayScrollbarStateToHidden):
(WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
(WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
(WebCore::ScrollAnimatorMac::updateScrollerStyle):
Add proper conforming to protocols and replace ids with proper types.

platform/mac/ScrollbarThemeMac.mm:

(WebCore::supportsExpandedScrollbars):
(WebCore::ScrollbarThemeMac::registerScrollbar):
(WebCore::ScrollbarThemeMac::scrollbarThickness):
(WebCore::ScrollbarThemeMac::setUpContentShadowLayer):
Stop using NSClassFromString now that we can reference the classes explicitly.

platform/spi/mac/NSScrollerImpSPI.h: Added.

5:34 PM Changeset in webkit [196245] by Yusuke Suzuki

6 edits in trunk

[GTK][EFL] Enable SamplingProfiler
https://bugs.webkit.org/show_bug.cgi?id=153638

Reviewed by Michael Catanzaro.

Enable SamplingProfiler in GTK and EFL.
And added option to CMake to switch this from the build command.

Source/cmake/OptionsEfl.cmake:
Source/cmake/OptionsGTK.cmake:
Source/cmake/WebKitFeatures.cmake:

Source/WTF:

wtf/Platform.h:

4:33 PM Changeset in webkit [196244] by Alan Bujtas

145 edits
2 adds in trunk

Outline does not clip when ancestor has overflow: hidden and requires layer.
https://bugs.webkit.org/show_bug.cgi?id=153901

Now that outline is part of visual overflow, we no longer need the special outline cliprect.
PaintPhaseChildOutlines drawing will switch to foreground cliprect. It ensures proper overflow clipping
at parent level. PaintPhaseSelfOutline drawing will start using the visual overflow inflated background cliprect.
With this change, outline will be using the same cliprects as the other visual overflow properties (box-shadow etc).

Reviewed by David Hyatt.

Source/WebCore:

Test: fast/repaint/outline-with-overflow-hidden-ancestor.html

rendering/LayerFragment.h:

(WebCore::LayerFragment::setRects):
(WebCore::LayerFragment::moveBy): Deleted.
(WebCore::LayerFragment::intersect): Deleted.

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::collectFragments):
(WebCore::RenderLayer::paintOutlineForFragments):
(WebCore::RenderLayer::calculateClipRects):
(WebCore::RenderLayer::paintForegroundForFragments): Deleted.

rendering/RenderLayer.h:
rendering/RenderTreeAsText.cpp:

(WebCore::write):
(WebCore::writeLayers):

LayoutTests:

compositing/geometry/limit-layer-bounds-overflow-repaint-expected.txt:
compositing/masks/mask-of-clipped-layer-expected.txt:
css2.1/20110323/abspos-non-replaced-width-margin-000-expected.txt:
css2.1/20110323/abspos-replaced-width-margin-000-expected.txt:
css3/blending/blend-mode-isolation-turn-off-self-painting-layer2-expected.txt:
css3/blending/blend-mode-isolation-turn-on-self-painting-layer-expected.txt:
fast/block/positioning/negative-rel-position-expected.txt:
fast/dynamic/staticY-expected.txt:
fast/inline/absolute-positioned-block-in-centred-block-expected.txt:
fast/multicol/flipped-blocks-border-after-expected.txt:
fast/multicol/pagination-h-horizontal-bt-expected.txt:
fast/multicol/pagination-h-horizontal-tb-expected.txt:
fast/multicol/pagination-h-vertical-rl-expected.txt:
fast/multicol/pagination-v-horizontal-bt-expected.txt:
fast/multicol/pagination-v-vertical-lr-expected.txt:
fast/multicol/pagination-v-vertical-rl-expected.txt:
fast/multicol/pagination/LeftToRight-tb-hittest-expected.txt:
fast/multicol/pagination/RightToLeft-rl-hittest-expected.txt:
fast/multicol/progression-reverse-expected.txt:
fast/multicol/vertical-rl/rules-with-border-before-expected.txt:
fast/overflow/overflow-update-transform-expected.txt:
fast/overflow/position-relative-expected.txt:
fast/repaint/focus-ring-expected.txt:
fast/repaint/focus-ring-repaint.html:
fast/repaint/outline-with-overflow-hidden-ancestor-expected.html: Added.
fast/repaint/outline-with-overflow-hidden-ancestor.html: Added.
fast/table/overflow-table-collapsed-borders-cell-painting-expected.txt:
fast/table/overflow-table-collapsed-borders-cell-painting-table-self-painting-layer-expected.txt:
fast/table/overflow-table-collapsed-borders-section-layer-painting-expected.txt:
fast/table/overflow-table-collapsed-borders-section-layer-table-self-painting-layer-expected.txt:
fast/table/overflow-table-collapsed-borders-section-self-painting-layer-painting-expected.txt:
fast/table/overflow-table-collapsed-borders-section-self-painting-layer-table-self-painting-layer-expected.txt:
platform/mac/compositing/geometry/clipping-foreground-expected.txt:
platform/mac/compositing/geometry/root-layer-update-expected.txt:
platform/mac/compositing/overflow/ancestor-overflow-expected.txt:
platform/mac/compositing/overflow/nested-scrolling-expected.txt:
platform/mac/compositing/overflow/overflow-scroll-expected.txt:
platform/mac/compositing/overflow/parent-overflow-expected.txt:
platform/mac/compositing/overflow/scrollbar-painting-expected.txt:
platform/mac/compositing/reflections/nested-reflection-on-overflow-expected.txt:
platform/mac/compositing/sibling-positioning-expected.txt:
platform/mac/css3/blending/blend-mode-overflow-expected.txt:
platform/mac/css3/unicode-bidi-isolate-basic-expected.txt:
platform/mac/fast/block/float/overhanging-tall-block-expected.txt:
platform/mac/fast/block/positioning/auto/vertical-rl/007-expected.txt:
platform/mac/fast/block/positioning/vertical-rl/fixed-positioning-expected.txt:
platform/mac/fast/borders/border-antialiasing-expected.txt:
platform/mac/fast/clip/001-expected.txt:
platform/mac/fast/clip/013-expected.txt:
platform/mac/fast/clip/014-expected.txt:
platform/mac/fast/clip/016-expected.txt:
platform/mac/fast/clip/outline-overflowClip-expected.txt:
platform/mac/fast/css/clip-zooming-expected.txt:
platform/mac/fast/forms/validation-message-appearance-expected.txt:
platform/mac/fast/inline/left-right-center-inline-alignment-in-ltr-and-rtl-blocks-expected.txt:
platform/mac/fast/line-grid/line-grid-inside-columns-expected.txt:
platform/mac/fast/line-grid/line-grid-into-columns-expected.txt:
platform/mac/fast/lists/scrolled-marker-paint-expected.txt:
platform/mac/fast/multicol/client-rects-expected.txt:
platform/mac/fast/multicol/column-break-with-balancing-expected.txt:
platform/mac/fast/multicol/column-rules-expected.txt:
platform/mac/fast/multicol/column-rules-stacking-expected.txt:
platform/mac/fast/multicol/columns-shorthand-parsing-expected.txt:
platform/mac/fast/multicol/float-paginate-complex-expected.txt:
platform/mac/fast/multicol/float-paginate-empty-lines-expected.txt:
platform/mac/fast/multicol/float-paginate-expected.txt:
platform/mac/fast/multicol/layers-in-multicol-expected.txt:
platform/mac/fast/multicol/layers-split-across-columns-expected.txt:
platform/mac/fast/multicol/max-height-columns-block-expected.txt:
platform/mac/fast/multicol/nested-columns-expected.txt:
platform/mac/fast/multicol/newmulticol/client-rects-expected.txt:
platform/mac/fast/multicol/overflow-across-columns-expected.txt:
platform/mac/fast/multicol/overflow-across-columns-percent-height-expected.txt:
platform/mac/fast/multicol/overflow-unsplittable-expected.txt:
platform/mac/fast/multicol/paginate-block-replaced-expected.txt:
platform/mac/fast/multicol/pagination/BottomToTop-bt-expected.txt:
platform/mac/fast/multicol/pagination/BottomToTop-lr-expected.txt:
platform/mac/fast/multicol/pagination/BottomToTop-rl-expected.txt:
platform/mac/fast/multicol/pagination/BottomToTop-tb-expected.txt:
platform/mac/fast/multicol/pagination/LeftToRight-bt-expected.txt:
platform/mac/fast/multicol/pagination/LeftToRight-rl-expected.txt:
platform/mac/fast/multicol/pagination/LeftToRight-tb-expected.txt:
platform/mac/fast/multicol/pagination/RightToLeft-bt-expected.txt:
platform/mac/fast/multicol/pagination/RightToLeft-lr-expected.txt:
platform/mac/fast/multicol/pagination/RightToLeft-rl-dynamic-expected.txt:
platform/mac/fast/multicol/pagination/RightToLeft-rl-expected.txt:
platform/mac/fast/multicol/pagination/RightToLeft-tb-expected.txt:
platform/mac/fast/multicol/pagination/TopToBottom-bt-expected.txt:
platform/mac/fast/multicol/pagination/TopToBottom-lr-expected.txt:
platform/mac/fast/multicol/pagination/TopToBottom-rl-expected.txt:
platform/mac/fast/multicol/positive-leading-expected.txt:
platform/mac/fast/multicol/scrolling-column-rules-expected.txt:
platform/mac/fast/multicol/scrolling-overflow-expected.txt:
platform/mac/fast/multicol/span/anonymous-style-inheritance-expected.txt:
platform/mac/fast/multicol/span/span-as-immediate-child-complex-splitting-expected.txt:
platform/mac/fast/multicol/span/span-as-immediate-child-generated-content-expected.txt:
platform/mac/fast/multicol/span/span-as-immediate-child-property-removal-expected.txt:
platform/mac/fast/multicol/span/span-as-immediate-columns-child-dynamic-expected.txt:
platform/mac/fast/multicol/span/span-as-immediate-columns-child-expected.txt:
platform/mac/fast/multicol/span/span-as-immediate-columns-child-removal-expected.txt:
platform/mac/fast/multicol/span/span-as-nested-columns-child-dynamic-expected.txt:
platform/mac/fast/multicol/span/span-as-nested-columns-child-expected.txt:
platform/mac/fast/multicol/span/span-margin-collapsing-expected.txt:
platform/mac/fast/multicol/table-vertical-align-expected.txt:
platform/mac/fast/multicol/tall-image-behavior-expected.txt:
platform/mac/fast/multicol/vertical-lr/column-break-with-balancing-expected.txt:
platform/mac/fast/multicol/vertical-lr/column-rules-expected.txt:
platform/mac/fast/multicol/vertical-lr/float-multicol-expected.txt:
platform/mac/fast/multicol/vertical-lr/float-paginate-complex-expected.txt:
platform/mac/fast/multicol/vertical-lr/float-paginate-expected.txt:
platform/mac/fast/multicol/vertical-lr/nested-columns-expected.txt:
platform/mac/fast/multicol/vertical-rl/column-break-with-balancing-expected.txt:
platform/mac/fast/multicol/vertical-rl/column-rules-expected.txt:
platform/mac/fast/multicol/vertical-rl/float-multicol-expected.txt:
platform/mac/fast/multicol/vertical-rl/float-paginate-complex-expected.txt:
platform/mac/fast/multicol/vertical-rl/float-paginate-expected.txt:
platform/mac/fast/multicol/vertical-rl/nested-columns-expected.txt:
platform/mac/fast/overflow/clip-rects-fixed-ancestor-expected.txt:
platform/mac/fast/overflow/float-in-relpositioned-expected.txt:
platform/mac/fast/overflow/overflow-auto-position-absolute-expected.txt:
platform/mac/fast/overflow/overflow-rtl-expected.txt:
platform/mac/fast/overflow/paged-x-div-expected.txt:
platform/mac/fast/overflow/paged-x-div-with-column-gap-expected.txt:
platform/mac/fast/overflow/paged-x-on-root-expected.txt:
platform/mac/fast/overflow/paged-x-with-column-gap-expected.txt:
platform/mac/fast/overflow/paged-y-div-expected.txt:
platform/mac/fast/overflow/scroll-nested-positioned-layer-in-overflow-expected.txt:
platform/mac/fast/regions/repaint/region-painting-via-layout-expected.txt:
platform/mac/fast/repaint/box-shadow-h-expected.txt:
platform/mac/fast/repaint/box-shadow-v-expected.txt:
platform/mac/fast/repaint/layer-outline-expected.txt:
platform/mac/fast/repaint/layer-outline-horizontal-expected.txt:
platform/mac/fast/table/edge-offsets-expected.txt:
platform/mac/fast/transforms/overflow-with-transform-expected.txt:
platform/mac/fast/transforms/rotated-transform-affects-scrolling-1-expected.txt:
platform/mac/fast/transforms/rotated-transform-affects-scrolling-2-expected.txt:
platform/mac/fast/writing-mode/Kusa-Makura-background-canvas-expected.txt:
platform/mac/printing/single-line-must-not-be-split-into-two-pages-expected.txt:
platform/mac/scrollbars/scrollbars-on-positioned-content-expected.txt:
platform/mac/svg/custom/getscreenctm-in-scrollable-div-area-nested-expected.txt:
platform/mac/svg/custom/image-rescale-clip-expected.txt:
svg/overflow/overflow-on-foreignObject-expected.txt:

3:16 PM Changeset in webkit [196243] by sbarati@apple.com

3 edits
3 adds in trunk

Source/JavaScriptCore:
Follow up patch to: [ES6] bound functions .name property should be "bound " + the target function's name
https://bugs.webkit.org/show_bug.cgi?id=153796

Reviewed by Darin Adler.

This follow-up patch addresses some comments/suggestions by
Ryosuke, Darin, and Joe. It simplifies JSBoundFunction::toStringName
and adds some tests for bound names.

runtime/JSBoundFunction.cpp:

(JSC::hasInstanceBoundFunction):
(JSC::JSBoundFunction::create):
(JSC::JSBoundFunction::toStringName):

LayoutTests:
[ES6] bound functions .name property should be "bound " + the target function's name
https://bugs.webkit.org/show_bug.cgi?id=153796

Reviewed by Darin Adler.

js/bound-function-name-expected.txt: Added.
js/bound-function-name.html: Added.
js/script-tests/bound-function-name.js: Added.

(assert):
(assert.foo):
(bar):

2:26 PM Changeset in webkit [196242] by dbates@webkit.org

26 edits
6 adds in trunk

CSP: Allow Web Workers initiated from an isolated world to bypass the main world Content Security Policy
https://bugs.webkit.org/show_bug.cgi?id=153622
<rdar://problem/24400023>

Source/WebCore:

Reviewed by Gavin Barraclough.

Fixes an issue where Web Workers initiated from an isolated world (say, a Safari Content Script Extension)
would be subject to the Content Security Policy of the page.

Currently code in an isolated world that does not execute in a Web Worker is exempt from the CSP of
the page. However, code that runs inside a Web Worker that was initiated from an isolated world is
subject to the CSP of the page. Instead, such Web Worker code should also be exempt from the CSP of
the page.

Tests: http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html

http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html
http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html

Modules/websockets/WebSocket.cpp:

(WebCore::WebSocket::connect): Modified to ask the script execution context whether to bypass the
main world Content Security Policy now that script execution context knows this information.

bindings/js/ScriptController.cpp:

(WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy): Deleted; moved logic from here...

bindings/js/ScriptController.h:
dom/Document.cpp:

(WebCore::Document::shouldBypassMainWorldContentSecurityPolicy): ...to here.

dom/Document.h:
dom/ScriptExecutionContext.h:

(WebCore::ScriptExecutionContext::shouldBypassMainWorldContentSecurityPolicy): Added; defaults to false -
do not bypass the main world Content Security Policy.

page/EventSource.cpp:

(WebCore::EventSource::create): Modified to ask the script execution context whether to bypass the
main world Content Security Policy now that script execution context knows this information.

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::shouldBypassMainWorldContentSecurityPolicy): Deleted.

page/csp/ContentSecurityPolicy.h:
workers/AbstractWorker.cpp:

(WebCore::AbstractWorker::resolveURL): Bypass the main world Content Security Policy if applicable.
Added FIXME comment to enforce the child-src directive of the document's CSP (as opposed to the script-src
directive) on the worker's script URL. Also, scriptExecutionContext()->contentSecurityPolicy() should
always be non-null just as we expect scriptExecutionContext()->securityOrigin() to be non-null. Assert
this invariant to catch cases where a ScriptExecutionContext is not properly initialized.

workers/DedicatedWorkerGlobalScope.cpp:

(WebCore::DedicatedWorkerGlobalScope::create): Modified to take boolean argument shouldBypassMainWorldContentSecurityPolicy
as to whether to bypass the main world Content Security Policy and only apply the Content Security
Policy headers when shouldBypassMainWorldContentSecurityPolicy is false.
(WebCore::DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
as to whether to bypass the main world Content Security Policy.

workers/DedicatedWorkerGlobalScope.h:
workers/DedicatedWorkerThread.cpp:

(WebCore::DedicatedWorkerThread::DedicatedWorkerThread): Ditto.
(WebCore::DedicatedWorkerThread::createWorkerGlobalScope): Ditto.

workers/DedicatedWorkerThread.h:
workers/Worker.cpp:

(WebCore::Worker::create): Store whether we should bypass the main world Content Security Policy so
that we can pass it to WorkerMessagingProxy::startWorkerGlobalScope() in Worker::notifyFinished().
We need to store this decision here as opposed to determining it at any later time (say, in Worker::notifyFinished())
because it is dependent on the current JavaScript program stack at the time this function is invoked.
(WebCore::Worker::notifyFinished): Pass whether to bypass the main world Content Security Policy.

workers/Worker.h:
workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::WorkerGlobalScope): Modified to take a boolean as to whether to bypass the
main world Content Security Policy and store it in a member field. Also, always instantiate a Content
Security Policy object as our current code assumes that one is always created.

workers/WorkerGlobalScope.h:
workers/WorkerGlobalScopeProxy.h:
workers/WorkerMessagingProxy.cpp:

(WebCore::WorkerMessagingProxy::startWorkerGlobalScope): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
as to whether to bypass the main world Content Security Policy.

workers/WorkerMessagingProxy.h:
workers/WorkerThread.cpp:

(WebCore::WorkerThreadStartupData::WorkerThreadStartupData): Modified to take a boolean argument as to
whether to bypass the main world Content Security Policy and store it in a member field.
(WebCore::WorkerThread::WorkerThread): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
as to whether to bypass the main world Content Security Policy.
(WebCore::WorkerThread::workerThread): Ditto.

workers/WorkerThread.h:
xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::open): Modified to ask the script execution context whether to bypass the
main world Content Security Policy now that script execution context knows this information.

LayoutTests:

Reviewed by Gavin Barraclough and Andy Estes.

Add tests to ensure that a Web Worker initiated from an isolated world can bypass the main world
Content Security Policy.

http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker-expected.txt: Added.
http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html: Added.

11:25 AM Changeset in webkit [196241] by commit-queue@webkit.org

4 edits in trunk

[cmake] Move LLVM detection for LLVMDisassembler to OptionsCommon.cmake
https://bugs.webkit.org/show_bug.cgi?id=153961

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-07
Reviewed by Michael Catanzaro.

Source/cmake/OptionsCommon.cmake:
Source/cmake/OptionsEfl.cmake:
Source/cmake/OptionsGTK.cmake:

11:03 AM Changeset in webkit [196240] by fpizlo@apple.com

4 edits in trunk/Source/JavaScriptCore

String.match should defend against matches that would crash the VM
https://bugs.webkit.org/show_bug.cgi?id=153964
rdar://problem/24301119

Reviewed by Saam Barati.

This fixes a crash in an internal test case.

runtime/ArgList.cpp:

(JSC::MarkedArgumentBuffer::slowAppend): Use best practices to ensure that the size we

compute makes sense. Crash if it stops making sense, since most users of this API assume
that they are creating something small enough to fit on the stack.

runtime/ArgList.h:

(JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
(JSC::MarkedArgumentBuffer::size):
(JSC::MarkedArgumentBuffer::operator new): Deleted. These were ineffective. According to the

debugger, we were still calling system malloc. So, I changed the code to use fastMalloc()
directly.

(JSC::MarkedArgumentBuffer::operator delete): Deleted.

runtime/StringPrototype.cpp:

(JSC::stringProtoFuncMatch): Explicitly defend against absurd sizes. Of course, it's still

possible to crash the VM on OOME. That's sort of always been the philosophy of JSC - we
don't guarantee that you'll get a nice-looking error whenever you run out of memory,
since in a GC'd environment you can't really guarantee those things. But, if you have a
match that obvious won't fit in memory, then reporting an error is useful in case this is
a developer experimenting with a buggy regexp.

10:44 AM Changeset in webkit [196239] by mitz@apple.com

21 edits in trunk/Source

[Cocoa] Replace has_include guards around inclusion of Apple-internal-SDK headers with USE(APPLE_INTERNAL_SDK)
https://bugs.webkit.org/show_bug.cgi?id=153963

Reviewed by Sam Weinig.

Source/JavaScriptCore:

inspector/remote/RemoteInspectorXPCConnection.mm:

Source/WebCore:

accessibility/mac/AXObjectCacheMac.mm:
crypto/CommonCryptoUtilities.cpp:
crypto/CommonCryptoUtilities.h:
editing/mac/TextUndoInsertionMarkupMac.h:
editing/mac/TextUndoInsertionMarkupMac.mm:
platform/cocoa/TelephoneNumberDetectorCocoa.cpp:
platform/graphics/cg/ImageSourceCG.cpp:
platform/graphics/mac/PDFDocumentImageMac.mm:
platform/network/ios/NetworkStateNotifierIOS.mm:
platform/network/mac/BlobDataFileReferenceMac.mm:
platform/network/mac/ResourceHandleMac.mm:
rendering/RenderThemeMac.mm:

Source/WebKit/mac:

WebView/WebPDFView.mm:

Source/WTF:

wtf/SystemTracing.h:
wtf/WTFThreadData.h:
wtf/spi/darwin/CommonCryptoSPI.h:

2:09 AM Changeset in webkit [196238] by Carlos Garcia Campos

4 edits in trunk

REGRESSION(r195661): [GTK] Scrollbar tests crashing after overlay scrollbar groundwork
https://bugs.webkit.org/show_bug.cgi?id=153695

Reviewed by Michael Catanzaro.

Source/WebCore:

The problem is that ScrollAnimation objects are not destroyed by
the ScrollAnimator destructor, because I forgot to add a virtual
destructor for ScrollAnimation in r195661.

platform/ScrollAnimation.h:

(WebCore::ScrollAnimation::~ScrollAnimation):

LayoutTests:

platform/gtk/TestExpectations:

Feb 6, 2016:

10:34 PM Changeset in webkit [196237] by Chris Dumez

9 edits in trunk/LayoutTests

Unreviewed, update several layout tests for WK1 after r196227.

http/tests/security/cross-frame-access-enumeration-expected.txt:
http/tests/security/cross-frame-access-enumeration.html:
http/tests/security/cross-frame-access-get-expected.txt:
http/tests/security/cross-frame-access-get.html:
http/tests/security/cross-frame-access-history-get-expected.txt:
http/tests/security/cross-frame-access-history-get-override-expected.txt:
http/tests/security/cross-frame-access-history-get-override.html:
http/tests/security/cross-frame-access-history-get.html:

9:55 PM Changeset in webkit [196236] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

REGRESSION (r195432): Web Inspector: bottom right section of the styles sidebar is 1px taller than the console prompt
https://bugs.webkit.org/show_bug.cgi?id=153959
<rdar://problem/24541053>

Reviewed by Timothy Hatcher.

UserInterface/Views/CSSStyleDetailsSidebarPanel.css:

(.sidebar > .panel.details.css-style > .content ~ .options-container):
(.sidebar > .panel.details.css-style > .content ~ .class-list-container)::
Revert the height to what it used to be prior r195432.

6:21 PM WebKitGTK/Gardening/Calendar edited by Michael Catanzaro

(diff)

6:17 PM Changeset in webkit [196235] by Michael Catanzaro

5 edits in trunk/LayoutTests

[GTK] Rebaseline some tests and update expectations after r196222

Unreviewed test gardening.

platform/gtk/TestExpectations:
platform/gtk/fast/clip/outline-overflowClip-expected.txt:
platform/gtk/fast/repaint/layer-outline-expected.txt:
platform/gtk/fast/repaint/layer-outline-horizontal-expected.txt:

6:03 PM Changeset in webkit [196234] by dbates@webkit.org

2 edits in trunk/Source/WebKit2

Call CFRelease() on SecRequirementRef when no longer needed
https://bugs.webkit.org/show_bug.cgi?id=153954
<rdar://problem/24540259>

Reviewed by Dan Bernstein.

Shared/mac/ChildProcessMac.mm:

(WebKit::ChildProcess::initializeSandbox):

5:52 PM Changeset in webkit [196233] by Michael Catanzaro

2 edits in trunk/LayoutTests

[GTK] imported/blink/compositing/squashing/abspos-under-abspos-overflow-scroll.html is flaky

Unreviewed test gardening.

platform/gtk/TestExpectations:

5:51 PM Changeset in webkit [196232] by fpizlo@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

FTL must store the call site index before runtime calls, even if it's the tail call slow path
https://bugs.webkit.org/show_bug.cgi?id=153955
rdar://problem/24290970

Reviewed by Saam Barati.

This is necessary because you could throw an exception in a host call on the tail call's slow
path. That'll route us to lookupExceptionHandler(), which unwinds starting with the call site
index of our frame. Bad things happen if it's not set. Prior to this patch it was possible
for the call site index field to be uninitialized, which meant that the throwing machinery
was making a wild guess about where we are.

ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):

tests/stress/tail-call-host-call-throw.js: Added.

4:45 PM Changeset in webkit [196231] by jonlee@apple.com

2 edits in trunk/PerformanceTests

Code clean up: Move Rotater function closer to Stage static methods.
The Rotater is used together with those methods; keep them close.

Animometer/tests/resources/main.js:

4:39 PM Changeset in webkit [196230] by jonlee@apple.com

3 edits in trunk/PerformanceTests

Update the JS includes due to ResultsTable move.

Animometer/developer.html:
Animometer/index.html:

4:34 PM Changeset in webkit [196229] by jonlee@apple.com

7 edits in trunk/PerformanceTests

Move createElement and createSVGElement to Utilities.

Animometer/resources/extensions.js:

(Utilities.createElement): Added.
(Utilities.createSVGElement): Added.
(DocumentExtension.createElement): Deleted.
(DocumentExtension.createSvgElement): Deleted.

Animometer/resources/debug-runner/animometer.js:
Animometer/resources/runner/animometer.js:
Animometer/tests/bouncing-particles/resources/bouncing-svg-images.js:
Animometer/tests/bouncing-particles/resources/bouncing-svg-particles.js:
Animometer/tests/bouncing-particles/resources/bouncing-svg-shapes.js:

4:27 PM Changeset in webkit [196228] by jonlee@apple.com

10 edits in trunk/PerformanceTests

Add a convenience function for creating a class.

The pattern for creating a class is common enough to add as a Utilities
helper function. It also makes it easy to collapse class definitions when
editing.

Animometer/resources/debug-runner/animometer.js: Move ProgressBar definition,

since it is only used here.

Animometer/resources/runner/animometer.js: Move ResultsDashboard and

ResultsTable definition, since it is only used here.

Animometer/resources/extensions.js: Move Utilities definition to the top. Convert

Point, Insets, SimplePromise.
(ProgressBar): Moved to animometer.js.
(ResultsDashboard): Moved to animometer.js.
(ResultsTable): Moved to animometer.js.

Animometer/resources/runner/benchmark-runner.js: Convert BenchmarkRunnerState,

BenchmarkRunner.

Animometer/tests/resources/main.js: Convert Rotater, Stage, Animator, Benchmark.
Animometer/tests/resources/sampler.js: Convert Experiment, Sampler.

Convert test primitives.

Animometer/tests/master/resources/canvas-tests.js: Convert CanvasLineSegment,

CanvasArc, CanvasLinePoint.

Animometer/tests/simple/resources/simple-canvas-paths.js: Convert CanvasLineSegment,

CanvasLinePoint, CanvasQuadraticSegment, CanvasQuadraticPoint, CanvasBezierSegment,
CanvasBezierPoint, CanvasArcToSegment, CanvasArcToSegmentFill, CanvasArcSegment,
CanvasArcSegmentFill, CanvasRect, CanvasRectFill.

Animometer/tests/simple/resources/tiled-canvas-image.js: Convert CanvasImageTile.

4:18 PM Changeset in webkit [196227] by Chris Dumez

18 edits
2 deletes in trunk

Prevent cross-origin access to window.history
https://bugs.webkit.org/show_bug.cgi?id=153931

Reviewed by Darin Adler.

Source/WebCore:

Prevent cross-origin access to window.history to match the specification [1]
and the behavior of other browsers (tested Firefox and Chrome).

[1] https://html.spec.whatwg.org/multipage/browsers.html#security-window

No new tests, already covered by existing tests that
were updated in this patch.

bindings/js/JSHistoryCustom.cpp:

(WebCore::JSHistory::pushState):
(WebCore::JSHistory::replaceState):
(WebCore::JSHistory::state): Deleted.

page/DOMWindow.idl:
page/History.idl:

LayoutTests:

Update / rebaseline several layout tests now that cross-origin access to
window.history is prevented.

fast/frames/sandboxed-iframe-history-denied-expected.txt:
http/tests/history/cross-origin-replace-history-object-child-expected.txt:
http/tests/security/cross-frame-access-call-expected.txt:
http/tests/security/cross-frame-access-call.html:
http/tests/security/cross-frame-access-delete-expected.txt:
http/tests/security/cross-frame-access-delete.html:
http/tests/security/cross-frame-access-history-prototype-expected.txt:
http/tests/security/cross-frame-access-history-put.html: Removed.
http/tests/security/cross-frame-access-object-getPrototypeOf-expected.txt:
http/tests/security/cross-frame-access-object-getPrototypeOf.html:
http/tests/security/cross-frame-access-object-setPrototypeOf-expected.txt:
http/tests/security/cross-frame-access-object-setPrototypeOf.html:
http/tests/security/resources/cross-frame-iframe-for-history-put-test.html: Removed.

3:41 PM Changeset in webkit [196226] by Beth Dakin

3 edits in trunk/Source/WebCore

ScrollbarPainters needs to be deallocated on the main thread
https://bugs.webkit.org/show_bug.cgi?id=153932
-and corresponding-
rdar://problem/24015483

Reviewed by Dan Bernstein.

Darin pointed out that this was still race-y. There was still a race
condition between the destruction of the two local variables and the
destruction of the lambda on the main thread. This should fix that.

page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:

(WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
(WebCore::ScrollingTreeFrameScrollingNodeMac::releaseReferencesToScrollbarPaintersOnTheMainThread):
(WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

3:36 PM Changeset in webkit [196225] by jonlee@apple.com

5 edits in trunk/PerformanceTests

Minor improvements to debug harness.

Animometer/developer.html:
Animometer/resources/debug-runner/animometer.css:

(#suites): Put the complexity text boxes closer to the test names.
(#options):
(#rawFPS circle): Make the interval FPS appear as a separate data series, with a line.
(#intervalFPS path):
(#intervalFPS circle):

Animometer/resources/debug-runner/animometer.js:

(window.optionsManager.updateLocalStorageFromUI): Convert number inputs from text.
(window.suitesManager._onChangeTestCheckbox): Refactor to take a checkbox.
(window.suitesManager._createTestElement): Enhance such that typing into the complexity
input will automatically select that test for running.
(window.suitesManager.updateLocalStorageFromJSON): Make the harness work for private
browsing.

Animometer/resources/debug-runner/graph.js: Separate the intervalFPS data, and show

more accuracy in timestamps.

3:31 PM Changeset in webkit [196224] by jonlee@apple.com

12 edits in trunk/PerformanceTests

Refactor helper methods for getting random values for a stage.

Instead of requiring a Stage instance, just attach it to the Stage object.

Animometer/tests/bouncing-particles/resources/bouncing-canvas-shapes.js:
Animometer/tests/bouncing-particles/resources/bouncing-css-shapes.js:
Animometer/tests/bouncing-particles/resources/bouncing-particles.js:
Animometer/tests/bouncing-particles/resources/bouncing-svg-shapes.js:
Animometer/tests/master/resources/canvas-tests.js:
Animometer/tests/master/resources/particles.js:
Animometer/tests/misc/resources/canvas-electrons.js:
Animometer/tests/misc/resources/canvas-stars.js:
Animometer/tests/misc/resources/compositing-transforms.js:
Animometer/tests/resources/main.js:
Animometer/tests/simple/resources/simple-canvas-paths.js:

3:18 PM Changeset in webkit [196223] by Darin Adler

57 edits in trunk/Source

Finish auditing call sites of upper() and lower(), eliminate many, and rename the functions
https://bugs.webkit.org/show_bug.cgi?id=153905

Reviewed by Sam Weinig.

Source/JavaScriptCore:

runtime/IntlObject.cpp:

(JSC::canonicalLangTag): Use converToASCIIUppercase on the language tag.

runtime/StringPrototype.cpp:

(JSC::stringProtoFuncToLowerCase): Tweak style and update for name change.
(JSC::stringProtoFuncToUpperCase): Ditto.

Source/WebCore:

Modules/mediasource/MediaSource.cpp:

(WebCore::MediaSource::isTypeSupported): Use convertToASCIILowercase on MIME type.

accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::selectText): Use new names for lower and upper. Also
tweaked style a tiny bit and used u_toupper rather than converting an entire
string to uppercase.

dom/Document.cpp:

(WebCore::Document::addImageElementByCaseFoldedUsemap): Renamed to reflect the use
of case folding rather than lowercasing.
(WebCore::Document::removeImageElementByCaseFoldedUsemap): Ditto.
(WebCore::Document::imageElementByCaseFoldedUsemap): Ditto.

dom/Document.h: Ditto.
dom/DocumentOrderedMap.cpp:

(WebCore::DocumentOrderedMap::getElementByCaseFoldedMapName): Ditto.
(WebCore::DocumentOrderedMap::getElementByCaseFoldedUsemap): Ditto.

dom/DocumentOrderedMap.h: Ditto.

dom/TreeScope.cpp:

(WebCore::TreeScope::getImageMap): Removed unneeded special case for null string.
Simplified logic for cases where the URL does not have a "#" character in it.
Use case folding instead of lowercase.

editing/cocoa/HTMLConverter.mm:

(HTMLConverter::_processText): Removed unneded special case for the empty string.
Use makCapitalized instead of Cocoa function for "capitalize". Use upper and lower
functions by their new names.

html/HTMLImageElement.cpp:

(WebCore::HTMLImageElement::parseAttribute): Use case folding instead of
lowerasing for the usemap attribute.
(WebCore::HTMLImageElement::insertedInto): Ditto.
(WebCore::HTMLImageElement::removedFrom): Ditto.
(WebCore::HTMLImageElement::matchesCaseFoldedUsemap): Ditto.

html/HTMLImageElement.h: Rename since usemap is case folded now, not lowercased.

html/HTMLMapElement.cpp:

(WebCore::HTMLMapElement::imageElement): Use case folding instead of lowercasing
for usemap.
(WebCore::HTMLMapElement::parseAttribute): Ditto.

platform/Language.cpp:

(WebCore::canonicalLanguageIdentifier): Use convertToASCIILowercase for language code.
(WebCore::indexOfBestMatchingLanguageInList): Ditto.

platform/graphics/harfbuzz/HarfBuzzShaper.cpp:

(WebCore::HarfBuzzShaper::shapeHarfBuzzRuns): Use new name for the upper function.

platform/network/HTTPParsers.cpp:

(WebCore::parseContentTypeOptionsHeader): Use equalLettersIgnoringASCIICase instead
of lowercasing to check for a specific header value.

platform/network/MIMEHeader.cpp:

(WebCore::retrieveKeyValuePairs): Use convertToASCIILowercase for MIME header name.
(WebCore::MIMEHeader::parseContentTransferEncoding): Use equalLettersIgnoringASCIICase
instead of lowercasing.

platform/network/cf/ResourceHandleCFNet.cpp:

(WebCore::allowsAnyHTTPSCertificateHosts): Make this hash ASCII case-insensitive.
(WebCore::clientCertificates): Ditto.
(WebCore::ResourceHandle::createCFURLConnection): Remove call to lower since the
set is now ASCII case-insensitive.
(WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Ditto.
(WebCore::ResourceHandle::setClientCertificate): Ditto.

platform/network/curl/CookieJarCurl.cpp:

(WebCore::getNetscapeCookieFormat): Use equalLettersIgnoringASCIICase instead of
lowercasing.

platform/network/curl/MultipartHandle.cpp:

(WebCore::MultipartHandle::didReceiveResponse): Use convertToASCIILowercase to
make a MIME type lowercase.

platform/network/curl/ResourceHandleCurl.cpp:

(WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Removed unneeded
conversion to lowercase now that the set is ASCII case-insensitive.
(WebCore::ResourceHandle::setClientCertificate): Removed code that populates a map
that is then never used for anything.

platform/network/curl/ResourceHandleManager.cpp:

(WebCore::headerCallback): Use convertToASCIILowercase for MIME type.

platform/network/curl/SSLHandle.cpp: Made hash maps keyed by host names

ASCII case-insensitive.
(WebCore::addAllowedClientCertificate): Removed lowercasing since the map itself
is now ASCII case insensitve.
(WebCore::setSSLClientCertificate): Ditto. Also use auto for iterator type so we
don't have to write out the map type.
(WebCore::sslIgnoreHTTPSCertificate): Ditto.
(WebCore::certVerifyCallback): Ditto.

platform/network/soup/ResourceHandleSoup.cpp: Made hash maps keyed by host names

ASCII case-insensitive.
(WebCore::allowsAnyHTTPSCertificateHosts): Ditto.
(WebCore::handleUnignoredTLSErrors): Ditto.
(WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Ditto.
(WebCore::ResourceHandle::setClientCertificate): Ditto.

platform/text/LocaleToScriptMappingDefault.cpp: Made hash maps keyed by script

names ASCII case-insensitive. USE WTF_ARRAY_LENGTH as appropriate.
(WebCore::scriptNameToCode): Use modern style to initialize the map. Removed
unnecessary lowercasing of the script name before looking at the map.
(WebCore::localeToScriptCodeForFontSelection): Ditto.

platform/text/win/LocaleWin.cpp:

(WebCore::convertLocaleNameToLCID): Made map ASCII case-insensitive and removed
unneeded lowercasing.

platform/win/PasteboardWin.cpp:

(WebCore::clipboardTypeFromMIMEType): Use equalLettersIgnoringASCIICase instead
of lowercasing.

rendering/RenderText.cpp:

(WebCore::applyTextTransform): Use new names for the upper and lower functions.

xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::responseIsXML): Remove unneeded lowercasing, since
DOMImplementation now has ASCII case-insensitive handling of MIME types.

Source/WebKit/mac:

Plugins/WebBasePluginPackage.mm:

(-[WebBasePluginPackage getPluginInfoFromPLists]): Use modern for loops.
(-[WebBasePluginPackage supportsExtension:]): Use convertToASCIILowercase for extension assert.
Also use modern for loop.
(-[WebBasePluginPackage supportsMIMEType:]): Ditto.
(-[WebBasePluginPackage MIMETypeForExtension:]): Ditto.

Source/WebKit/win:

Plugins/PluginDatabase.cpp:

(WebCore::PluginDatabase::pluginForMIMEType): Use ASCII case-insensitive map rather
than lowercasing the MIME type.
(WebCore::PluginDatabase::setPreferredPluginForMIMEType): Ditto.

Plugins/PluginDatabase.h: Make m_preferredPlugins use an ASCII case-insensitive hash.

Plugins/PluginPackage.h: Use ASCII case-insensitive hash for maps keyed by MIME type.

Plugins/PluginPackageWin.cpp:

(WebCore::PluginPackage::fetchInfo): Use convertToASCIILowercase to lowercase a MIME type.

Source/WebKit2:

NetworkProcess/CustomProtocols/CustomProtocolManager.h: Use ASCII case-insensitive hash

for set of registered schemes.

Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:

(WebKit::getPluginInfoFromPropertyLists): Use convertToASCIILowercase for MIME type and
for file extensions.

Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp:

(WebKit::NetscapePluginModule::parseMIMEDescription): Use convertToASCIILowercase for
MIME description.

UIProcess/API/efl/ewk_context.cpp:

(ewk_context_preferred_languages_set): Use convertToASCIILowercase for language.

UIProcess/API/gtk/WebKitWebContext.cpp:

(webkit_web_context_set_preferred_languages): Use convertToASCIILowercase for language.

UIProcess/Plugins/PluginInfoStore.cpp:

(WebKit::PluginInfoStore::findPluginForExtension): Use Vector::contains instead of
writing it out using std::find.
(WebKit::pathExtension): Lowercase the result with convertToASCIILowercase instead of
leaving that to the caller.
(WebKit::PluginInfoStore::findPlugin): Removed call to lower since pathExtension
handles that now.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::findPlugin): Use convertToASCIILowercase for MIME type.

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::globalURLSchemesWithCustomProtocolHandlers): Use
an ASCII case-insensitive hash.
(WebKit::WebProcessPool::registerGlobalURLSchemeAsHavingCustomProtocolHandlers):
Remove lowercasing, since the hash is now ASCII case-insensitive.
(WebKit::WebProcessPool::unregisterGlobalURLSchemeAsHavingCustomProtocolHandlers):
Ditto.

UIProcess/WebProcessPool.h: Use an ASCII case-insensitive hash.

WebProcess/Plugins/Netscape/NetscapePlugin.cpp:

(WebKit::NetscapePlugin::initialize): Use convertToASCIILowercase on parameter names
and values.

WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::pluginSupportsExtension): Use convertToASCIILowercase for extension assertion.
Also use a modern for loop.
(WebKit::WebFrameLoaderClient::objectContentType): Make the checks for empty MIME types
a little less redundant. Reordered logic to avoid checking the list of supported MIME
types extra times, and to eliminate the need for a boolean. Use convertToASCIILowercase
on the extension.

Source/WTF:

wtf/text/AtomicString.cpp:

(WTF::AtomicString::lower): Deleted.

wtf/text/AtomicString.h: Deleted the lower function.

wtf/text/StringImpl.cpp:

(WTF::StringImpl::convertToLowercaseWithoutLocale): Renamed from lower.
(WTF::StringImpl::convertToUppercaseWithoutLocale): Renamed from upper.
(WTF::StringImpl::convertToLowercaseWithLocale): Renamed from lower.
(WTF::StringImpl::convertToUppercaseWithLocale): Renamed from upper.
(WTF::StringImpl::foldCase): Added fast cases for ASCII since this is
now used in some more-performance-critical code.

wtf/text/StringImpl.h: Renamed lower and upper.

wtf/text/WTFString.cpp:

(WTF::String::convertToLowercaseWithoutLocale): Renamed from lower.
(WTF::String::convertToUppercaseWithoutLocale): Renamed from upper.
(WTF::String::convertToLowercaseWithLocale): Renamed from lower.
(WTF::String::convertToUppercaseWithLocale): Renamed from upper.

wtf/text/WTFString.h: Renamed lower and upper. Removed unneeded comment.

3:07 PM Changeset in webkit [196222] by Alan Bujtas

46 edits
4 adds in trunk

Outline should contribute to visual overflow.
https://bugs.webkit.org/show_bug.cgi?id=153299

This patch eliminates the special outline handling (RenderView::setMaximalOutlineSize).
Now that outline is part of visual overflow, we don't have to inflate the layers to accomodate
outline borders.
This patch fixes several focusring related repaint issues. However when both the outline: auto
and the descendant renderer are composited, we still don't paint properly in certain cases. -not a regression.
(Also when parent renderer has overflow: hidden repaint does not take outline into account. -regression.)
It changes column behavior (see TestExpectations) since outline behaves now like any other visual overflow properties.

Reviewed by David Hyatt.

Source/WebCore:

Test: fast/repaint/focus-ring-repaint.html

fast/repaint/focus-ring-repaint-with-negative-offset.html

css/html.css: resetting to old behavior.

(:focus):
(input:focus, textarea:focus, isindex:focus, keygen:focus, select:focus):

rendering/InlineFlowBox.cpp:

(WebCore::InlineFlowBox::addToLine):
(WebCore::InlineFlowBox::addOutlineVisualOverflow):
(WebCore::InlineFlowBox::computeOverflow):
(WebCore::InlineFlowBox::paint): Deleted.

rendering/InlineFlowBox.h:
rendering/RenderBlock.cpp:

(WebCore::RenderBlock::computeOverflow):
(WebCore::RenderBlock::outlineStyleForRepaint):
(WebCore::RenderBlock::paint): Deleted.

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::layoutBlock): Deleted.
(WebCore::RenderBlockFlow::addFocusRingRectsForInlineChildren): Deleted.

rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::addOverflowFromInlineChildren):

rendering/RenderBox.cpp:

(WebCore::RenderBox::addVisualEffectOverflow):
(WebCore::RenderBox::applyVisualEffectOverflow):
(WebCore::RenderBox::clippedOverflowRectForRepaint): Deleted.

rendering/RenderBoxModelObject.h:
rendering/RenderDetailsMarker.cpp:

(WebCore::RenderDetailsMarker::paint): Deleted.

rendering/RenderElement.cpp:

(WebCore::RenderElement::insertChildInternal):
(WebCore::RenderElement::styleDidChange):
(WebCore::RenderElement::repaintAfterLayoutIfNeeded):
(WebCore::RenderElement::issueRepaintForOutlineAuto):
(WebCore::RenderElement::updateOutlineAutoAncestor):
(WebCore::RenderElement::computeMaxOutlineSize): Deleted.
(WebCore::RenderElement::styleWillChange): Deleted.

rendering/RenderElement.h:

(WebCore::RenderElement::hasContinuation):

rendering/RenderInline.cpp:

(WebCore::RenderInline::paintOutlineForLine): Deleted.

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::calculateClipRects):

rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::anyLineIntersectsRect):
(WebCore::RenderLineBoxList::lineIntersectsDirtyRect):
(WebCore::RenderLineBoxList::paint):
(WebCore::isOutlinePhase): Deleted.

rendering/RenderLineBoxList.h:
rendering/RenderListBox.cpp:

(WebCore::RenderListBox::computePreferredLogicalWidths):

rendering/RenderListMarker.cpp:

(WebCore::RenderListMarker::paint): Deleted.

rendering/RenderObject.cpp:

(WebCore::RenderObject::propagateRepaintToParentWithOutlineAutoIfNeeded): The renderer with outline: auto is responsible for
painting focusring around the descendants. If we issued repaint only on the descendant when it changes,
the focusring would not refresh properly. We have to find the ancestor with outline: auto, inflate the repaint rect and
issue the repaint on the ancestor if we crossed repaint container.

(WebCore::RenderObject::repaintUsingContainer):
(WebCore::RenderObject::adjustRectForOutlineAndShadow):
(WebCore::RenderObject::setHasOutlineAutoAncestor):
(WebCore::RenderObject::adjustRectWithMaximumOutline): Deleted.

rendering/RenderObject.h: We mark the descendants of outline: auto so that

when a child renderer changes we can propagate the repaint to the ancestor with outline.

(WebCore::RenderObject::hasOutlineAutoAncestor):
(WebCore::RenderObject::RenderObjectRareData::RenderObjectRareData):

rendering/RenderRegion.cpp:

(WebCore::RenderRegion::overflowRectForFlowThreadPortion):

rendering/RenderReplaced.cpp:

(WebCore::RenderReplaced::shouldPaint): Deleted.
(WebCore::RenderReplaced::clippedOverflowRectForRepaint): Deleted.

rendering/RenderTable.cpp:

(WebCore::RenderTable::paint): Deleted.

rendering/RenderTableCell.cpp:

(WebCore::RenderTableCell::clippedOverflowRectForRepaint): Deleted.
(WebCore::RenderTableCell::paintCollapsedBorders): Deleted.

rendering/RenderTableRow.cpp:

(WebCore::RenderTableRow::layout):
(WebCore::RenderTableRow::clippedOverflowRectForRepaint): Deleted.

rendering/RenderTableSection.cpp:

(WebCore::RenderTableSection::layoutRows):
(WebCore::RenderTableSection::computeOverflowFromCells): Deleted.
(WebCore::RenderTableSection::paintObject): Deleted.

rendering/RenderTheme.h:

(WebCore::RenderTheme::platformFocusRingWidth):

rendering/RenderView.cpp:

(WebCore::RenderView::setMaximalOutlineSize): Deleted.

rendering/RenderView.h:
rendering/style/RenderStyle.cpp:

(WebCore::RenderStyle::changeAffectsVisualOverflow):
(WebCore::RenderStyle::outlineWidth):

rendering/style/RenderStyle.h:

LayoutTests:

fast/repaint/focus-ring-repaint-expected.txt: Added.
fast/repaint/focus-ring-repaint.html: Added.
fast/repaint/focus-ring-repaint-expected-with-negative-offset.txt: Added.
fast/repaint/focus-ring-repaint-with-negative-offset.html: Added.
TestExpectations:
platform/mac/TestExpectations:
platform/mac/compositing/geometry/ancestor-overflow-change-expected.txt:
platform/mac/compositing/geometry/composited-in-columns-expected.txt:
platform/mac/compositing/layer-creation/overlap-animation-container-expected.txt:
platform/mac/compositing/layer-creation/stacking-context-overlap-nested-expected.txt:
platform/mac/compositing/visibility/visibility-image-layers-dynamic-expected.txt:
platform/mac/fast/clip/outline-overflowClip-expected.txt:
platform/mac/fast/inline/continuation-outlines-with-layers-expected.txt:
platform/mac/fast/repaint/4776765-expected.txt: Added.
platform/mac/fast/repaint/focus-ring-expected.txt: Added.
platform/mac/fast/repaint/layer-outline-expected.txt:
platform/mac/fast/repaint/layer-outline-horizontal-expected.txt:
platform/mac/svg/custom/focus-ring-expected.txt:

10:14 AM Changeset in webkit [196221] by Michael Catanzaro

2 edits in trunk/LayoutTests

[GTK] Various tests are flaky

More unreviewed test gardening.

platform/gtk/TestExpectations:

10:13 AM WebKitGTK/Gardening/Calendar edited by Michael Catanzaro

(diff)

10:12 AM Changeset in webkit [196220] by Chris Dumez

7 edits
2 adds in trunk

Object.getOwnPropertyDescriptor() does not work on sub-frame's window
https://bugs.webkit.org/show_bug.cgi?id=153925

Reviewed by Darin Adler.

Source/JavaScriptCore:

Calling Object.getOwnPropertyDescriptor() on a sub-frame's window was
returning undefined for that window's own properties. The reason was
that the check getOwnPropertySlot() is using to make sure the
PropertySlot is not for a property coming from the prototype was wrong.

The check was checking that 'this != slotBase' which works fine unless
this is a JSProxy (e.g. JSDOMWindowShell). To handle proxies, the code
was also checking that 'slotBase.toThis() != this', attempting to
get the slotBase/Window's proxy. However, due to the implementation of
toThis(), we were getting the lexical global object's proxy instead of
slotBase's proxy. To avoid this issue, the new code explicitly checks
if 'this' is a JSProxy and makes sure 'JSProxy::target() != slotBase',
instead of using toThis().

runtime/JSObject.cpp:

(JSC::JSObject::getOwnPropertyDescriptor):

LayoutTests:

fast/dom/Window/getOwnPropertyDescriptor-other-window-expected.txt: Added.
fast/dom/Window/getOwnPropertyDescriptor-other-window.html: Added.

Add test case to test calling Object.getOwnPropertyDescriptor() on a
sub-frame's window.

http/tests/security/cross-origin-window-property-access-expected.txt:
http/tests/security/cross-origin-window-property-access.html:
Update test use use an iframe instead of opening a Window for convenience.
Use an actual cross-origin URL. The previous URL was same-origin and therefore the test would have failed if window.location was a proper getter/setter instead of a 'value' descriptor.
Add more tests to cover other Window properties (such as 'name') which are actual getter / setters to make sure using the current window's getter on a cross origin window does not bypass the security origin checks.

http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:
http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:
Drop checks for properties for which cross-origin access via

getOwnPropertyDescriptor() now works. They used to not work because of the bug
this patch fixes, and not due to security checks.

Most of these properties are part of the properties that the specification

states can be accessed cross-origin:

https://html.spec.whatwg.org/multipage/browsers.html#security-window

ALL of these properties could already be accessed cross origin via regular

property getters (e.g. crossOriginWindow.blur) in Safari 9 so there should not
be any reason for getOwnPropertyDescriptor() not to work.

I have also verified that Firefox allows cross-origin access for all these properties (via regular getters or getOwnPropertyDescriptor), except for the 'history' property. We may want to align our behavior here and prevent cross-origin access to 'window.history' but this is not a regression in this patch. You could already access crossOriginWindow.history in Safari 9.

9:33 AM WebKitGTK/Gardening/Calendar edited by Michael Catanzaro

(diff)

9:26 AM Changeset in webkit [196219] by Michael Catanzaro

2 edits in trunk/LayoutTests

[GTK] Various tests are flaky

Unreviewed test gardening.

platform/gtk/TestExpectations:

9:26 AM WebKitGTK/Gardening/Calendar edited by Michael Catanzaro

(diff)

9:01 AM Changeset in webkit [196218] by Michael Catanzaro

2 edits in trunk/LayoutTests

[GTK] Gardening for unexpected passes

Unreviewed test gardening.

platform/gtk/TestExpectations:

9:00 AM Changeset in webkit [196217] by akling@apple.com

7 edits in trunk/Source

[iOS] Throw away linked code when navigating to a new page.
<https://webkit.org/b/153851>

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

Add a VM API for throwing away linked code only.

runtime/VM.cpp:

(JSC::VM::deleteAllLinkedCode):

runtime/VM.h:

Source/WebCore:

When navigating to a new page, tell JSC to throw out any linked code it has lying around.
Linked code is tied to a specific global object, and as we're creating a new one for the
new page, none of it is useful to us here.

In the event that the user navigates back, the cost of relinking some code will be far
lower than the memory cost of keeping all of it around.

This landed previously but was rolled out due to a Speedometer regression. I've made one
minor but important change here: only throw away code if we're navigating away from an
existing history item. Or in other words, don't throw away code for "force peeks" or any
other navigations that are not traditional top-level main frame navigations.

bindings/js/GCController.cpp:

(WebCore::GCController::deleteAllLinkedCode):

bindings/js/GCController.h:
loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad):

7:55 AM WebKitGTK/Gardening/Calendar edited by Michael Catanzaro

Move myself to Saturday because Friday gardening sucks (diff)

5:44 AM Changeset in webkit [196216] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Added implementations of AXObjectCache methods for !HAVE(ACCESSIBILITY).
https://bugs.webkit.org/show_bug.cgi?id=153924

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-06
Reviewed by Andreas Kling.

No new tests needed.

accessibility/AXObjectCache.h:

(WebCore::AXObjectCache::ariaModalNode): Added stub implementation.
(WebCore::AXObjectCache::postLiveRegionChangeNotification): Ditto.
(WebCore::AXObjectCache::rangeForNodeContents): Ditto.
(WebCore::AXObjectCache::setIsSynchronizingSelection): Ditto.
(WebCore::AXObjectCache::setTextSelectionIntent): Ditto.
(WebCore::AXAttributeCacheEnabler::AXAttributeCacheEnabler): Ditto.
(WebCore::AXAttributeCacheEnabler::~AXAttributeCacheEnabler): Ditto.

4:51 AM Changeset in webkit [196215] by Antti Koivisto

3 edits in trunk/Source/WebCore

Use scope stack instead of nested TreeResolvers for shadow trees
https://bugs.webkit.org/show_bug.cgi?id=153893

Reviewed by Andreas Kling.

Make TreeResolver per-document. This is a step towards iterative style resolve.

This is done replacing use of nested TreeResolvers with a scope stack that maintains
the style resolver and the selector filter for the current tree scope.

style/StyleTreeResolver.cpp:

(WebCore::Style::ensurePlaceholderStyle):
(WebCore::Style::TreeResolver::Scope::Scope):
(WebCore::Style::TreeResolver::TreeResolver):
(WebCore::Style::shouldCreateRenderer):
(WebCore::Style::TreeResolver::styleForElement):
(WebCore::Style::TreeResolver::createRenderTreeForShadowRoot):
(WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
(WebCore::Style::TreeResolver::createRenderTreeRecursively):
(WebCore::Style::TreeResolver::resolveLocally):
(WebCore::Style::TreeResolver::resolveShadowTree):
(WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement):
(WebCore::Style::TreeResolver::resolveChildren):
(WebCore::Style::TreeResolver::resolveSlotAssignees):
(WebCore::Style::TreeResolver::resolveRecursively):
(WebCore::Style::TreeResolver::resolve):
(WebCore::Style::detachRenderTree):

style/StyleTreeResolver.h:

(WebCore::Style::TreeResolver::scope):
(WebCore::Style::TreeResolver::pushScope):
(WebCore::Style::TreeResolver::pushEnclosingScope):
(WebCore::Style::TreeResolver::popScope):

3:29 AM Changeset in webkit [196214] by Carlos Garcia Campos

2 edits in trunk/Source/WebKit2

Unreviewed. Fix more incorrect ASSERT introduced in r196053.

WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp:

(WebKit::NetscapePluginX11::handleMouseEvent):
(WebKit::NetscapePluginX11::handleWheelEvent):
(WebKit::NetscapePluginX11::setFocus):
(WebKit::NetscapePluginX11::handleMouseEnterEvent):
(WebKit::NetscapePluginX11::handleMouseLeaveEvent):
(WebKit::NetscapePluginX11::handleKeyboardEvent):

2:12 AM Changeset in webkit [196213] by commit-queue@webkit.org

7 edits in trunk/Source

Unreviewed, rolling out r196104.
https://bugs.webkit.org/show_bug.cgi?id=153940

Regressed Speedometer on iOS (Requested by kling on #webkit).

Reverted changeset:

"[iOS] Throw away linked code when navigating to a new page."
https://bugs.webkit.org/show_bug.cgi?id=153851
http://trac.webkit.org/changeset/196104

Feb 5, 2016:

11:00 PM Changeset in webkit [196212] by aakash_jain@apple.com

2 edits in trunk/Tools

tests fail if display sleeps while run-webkit-tests is running
https://bugs.webkit.org/show_bug.cgi?id=153919

Reviewed by Alexey Proskuryakov.

DumpRenderTree/mac/LayoutTestHelper.m:

(addDisplaySleepAssertion): Add the assertion so that the display doesn't turn off.
(releaseDisplaySleepAssertion): Release the DisplaySleep Assertion.
(simpleSignalHandler): Release the DisplaySleepAssertion in case of any iterrupt.

10:21 PM Changeset in webkit [196211] by commit-queue@webkit.org

3 edits
2 adds in trunk/PerformanceTests

Add a new graphics test for CanvasRenderingContext2D functions: getImageData and putImageData
https://bugs.webkit.org/show_bug.cgi?id=151716

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-02-05
Reviewed by Darin Adler.

The purpose of this test is to measure the performance of getImageData
and putImageData functions. This test draws a background on the canvas
and then gets some random tiles from this background and draw them in
destinations different from their original sources.

Animometer/resources/debug-runner/tests.js: Adding the new test to the canvas simple tests suite.

Animometer/resources/extensions.js:

(Array.prototype.shuffle): Shuffles the elements of an array.

(Point.zero): Returns a new Point object whose x and y are equal zero.
(Point.prototype.str): Used for debugging the Point object.

Animometer/tests/simple/resources/tiled-canvas-image.js: Added.

(CanvasImageTile):
(CanvasImageTile.prototype.getImageData):
(CanvasImageTile.prototype.putImageData):
(Stage.call.initialize):
(Stage.call._createTiles):
(Stage.call._nextTilePosition):
(Stage.call.tune):
(Stage.call._drawBackground):
(Stage.call.animate):
(Stage.call.complexity):
(Stage.call):

Animometer/tests/simple/tiled-canvas-image.html: Added.

8:53 PM Changeset in webkit [196210] by Michael Catanzaro

2 edits in trunk/LayoutTests

[GTK] Unreviewed test expectations gardening.

platform/gtk/TestExpectations:

8:51 PM WebKitGTK/Gardening/Calendar edited by Michael Catanzaro

(diff)

5:56 PM Changeset in webkit [196209] by matthew_hanson@apple.com

1 edit in branches/safari-601-branch/LayoutTests/platform/mac/TestExpectations

Skip ES6-related Layout Tests. rdar://problem/24190123

5:24 PM Changeset in webkit [196208] by Beth Dakin

2 edits in trunk/Source/WebCore

ScrollbarPainters needs to be deallocated on the main thread
https://bugs.webkit.org/show_bug.cgi?id=153932
-and corresponding-
rdar://problem/24015483

Reviewed by Geoff Garen.

Follow-up fix since the first one was still race-y.

page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:

(WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
(WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

5:15 PM Changeset in webkit [196207] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Visual Styles sidebar should be more forgiving to long labels
https://bugs.webkit.org/show_bug.cgi?id=153927
<rdar://problem/24343897>

Patch by Devin Rousso <Devin Rousso> on 2016-02-05
Reviewed by Timothy Hatcher.

If a label is too long for it's container, it overflows and is visible
above the rest of the elements nearby.

UserInterface/Views/VisualStylePropertyEditor.css:

(.visual-style-property-container > .visual-style-property-title):
Adds text overflow to properties that extend beyond the container's width.

UserInterface/Views/VisualStylePropertyEditor.js:

(WebInspector.VisualStylePropertyEditor):
Now also adds the label value as a title attribute to the element, just in
case the content overflows.

5:08 PM Changeset in webkit [196206] by Beth Dakin

2 edits in trunk/Source/WebCore

ScrollbarPainters needs to be deallocated on the main thread
https://bugs.webkit.org/show_bug.cgi?id=153932
-and corresponding-
rdar://problem/24015483

Reviewed by Tim Horton.

Ensure the the destructor of ScrollingTreeFrameScrollingNodeMac and the
assignments done in this class are not responsible for deallocating the
ScrollbarPainter.

page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:

(WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
(WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

5:08 PM Changeset in webkit [196205] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark css3/filters/multiple-filters-invalidation.html as flaky on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=153933

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

4:49 PM Changeset in webkit [196204] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking pageoverlay/overlay-small-frame-paints.html as flaky on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=153898

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

4:20 PM Changeset in webkit [196203] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.5/Source/JavaScriptCore

Merged r196197. rdar://problem/24534864

4:20 PM Changeset in webkit [196202] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking css3-text-decoration/text-underline-position/underline-visual-overflow-with-subpixel-position.html as failing on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=153315

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

4:19 PM Changeset in webkit [196201] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.5/Source

Versioning.

4:18 PM Changeset in webkit [196200] by Chris Dumez

17 edits
3 adds in trunk

Instance property getters / setters cannot be called on another instance of the same type
https://bugs.webkit.org/show_bug.cgi?id=153895

Reviewed by Gavin Barraclough.

Source/WebCore:

It should be possible to call instance property getters / setters on
other instances of the same type, as per the WEB IDL specification:

This matches the behavior of Firefox.

The issue without our bindings was that the getters / setters were
using |slotBase| instead of |thisValue| and therefore ended up using
the instance the getter was taken from instead of the actual target
object.

Test:
js/instance-property-getter-other-instance.html
js/instance-property-setter-other-instance.html

bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

Have instance getters / setters use thisValue instead of slotBase.
In the case of interfaces that have attributes on the instance for compatibility reasons, try the prototype object if |thisValue| does does have the right type, instead of using slotBase like previously. I believe this maintains the original compatibility intention while also behaving correctly when called on another instance.

bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
bindings/scripts/test/JS/JSTestEventConstructor.cpp:
bindings/scripts/test/JS/JSTestException.cpp:
bindings/scripts/test/JS/JSTestInterface.cpp:
bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
bindings/scripts/test/JS/JSTestNode.cpp:
bindings/scripts/test/JS/JSTestNondeterministic.cpp:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
bindings/scripts/test/JS/JSTestTypedefs.cpp:
bindings/scripts/test/JS/JSattribute.cpp:

Rebaseline bindings tests.

LayoutTests:

js/dom/script-tests/shadow-navigator-geolocation-in-strict-mode-does-not-throw.js:
js/dom/shadow-navigator-geolocation-in-strict-mode-does-not-throw-expected.txt:

Extend this layout test coverage to cover the getter case in addition to the
setter case. This test covers the compatibility mode where we don't throw.
I made sure to maintain this behavior when refactoring the bindings to avoid
breakage.

js/instance-property-getter-other-instance-expected.txt:

Rebaseline now that this test passes.

js/instance-property-setter-other-instance-expected.txt: Added.
js/instance-property-setter-other-instance.html: Added.

Add test to cover the setter case.

4:13 PM Changeset in webkit [196199] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.5

New tag.

4:13 PM Changeset in webkit [196198] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark http/tests/security/cross-frame-access-custom.html as flaky on ios-simulator-wk2
https://bugs.webkit.org/show_bug.cgi?id=153050

Unreviewed test gardening.

platform/ios-simulator-wk2/TestExpectations:

4:07 PM Changeset in webkit [196197] by achristensen@apple.com

2 edits in trunk/Source/JavaScriptCore

Fix internal Windows build
https://bugs.webkit.org/show_bug.cgi?id=153930
<rdar://problem/24534864>

Reviewed by Mark Lam.

JavaScriptCore.vcxproj/JavaScriptCore.proj:

I made a typo in r196144.

4:06 PM Changeset in webkit [196196] by Ryan Haddad

2 edits in trunk/LayoutTests

Skipping js/basic-set.html on Mac since it is already runs as a part of run-jsc-stress-tests
https://bugs.webkit.org/show_bug.cgi?id=153879

Unreviewed test gardening.

platform/mac/TestExpectations:

3:55 PM Changeset in webkit [196195] by rniwa@webkit.org

4 edits
1 move in trunk/Websites/perf.webkit.org

Testing with remote server cache is unusably slow
https://bugs.webkit.org/show_bug.cgi?id=153928

Reviewed by Chris Dumez.

Don't use the single process mode of httpd as it's way too slow even for testing.
Also we'll hit a null pointer crash (http://svn.apache.org/viewvc?view=revision&revision=1711479)

Since httpd exits immediately when launched in multi-process mode, remote-cache-server.py (renamed from
run-with-remote-server.py) now has "start" and "stop" commands to start/stop the Apache. Also added
"reset" command to reset the cache for convenience.

Install.md: Updated the instruction.
config.json: Fixed a typo: httpdErro*r*Log.
tools/remote-cache-server.py: Copied from Websites/perf.webkit.org/tools/run-with-remote-server.py.

Now takes one of the following commands: "start", "stop", and "reset".
(main):
(start_httpd): Extracted from main.
(stop_httpd): Added.

tools/remote-server-relay.conf: Removed redundant (duplicate) LoadModule's.
tools/run-with-remote-server.py: Removed.

3:32 PM Changeset in webkit [196194] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking imported/w3c/web-platform-tests/html/semantics/document-metadata/styling/LinkStyle.html as flaky on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=153929

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

3:25 PM Changeset in webkit [196193] by sbarati@apple.com

7 edits
2 adds in trunk

Web Inspector: Include SamplingProfiler's expression-level data for stack frames in the protocol
https://bugs.webkit.org/show_bug.cgi?id=153455
<rdar://problem/24335884>

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

We now send the sampling profiler's expression-level
line/column info in the inspector protocol.

inspector/agents/InspectorScriptProfilerAgent.cpp:

(Inspector::buildSamples):

inspector/protocol/ScriptProfiler.json:
runtime/SamplingProfiler.h:

(JSC::SamplingProfiler::StackFrame::hasExpressionInfo):

Source/WebInspectorUI:

JSC has been collecting expression-level data in the sampling
profiler, and with this patch, we now get that information
in the inspector. With this information, we probably have
all the data we need to make real heat maps.

UserInterface/Models/CallingContextTree.js:

(WebInspector.CallingContextTree.prototype.updateTreeWithStackTrace):
(WebInspector.CCTNode):
(WebInspector.CCTNode.prototype.findOrMakeChild):
(WebInspector.CCTNode.prototype.addTimestampAndExpressionLocation):
(WebInspector.CCTNode.prototype.addTimestamp): Deleted.

LayoutTests:

inspector/sampling-profiler/expression-location-info-expected.txt: Added.
inspector/sampling-profiler/expression-location-info.html: Added.

3:16 PM Changeset in webkit [196192] by bshafiei@apple.com

4 edits in tags/Safari-602.1.18.0.2/Source/bmalloc

Merged r196186. rdar://problem/18620635

2:30 PM Changeset in webkit [196191] by beidson@apple.com

7 edits in trunk/Source/WebCore

Modern IDB: UniqueIDBDatabase's m_databaseInfo is unsafely used from multiple threads.
https://bugs.webkit.org/show_bug.cgi?id=153912

Reviewed by Alex Christensen.

No new tests (Anything testable about this patch is already covered by existing tests).

Modules/indexeddb/server/IDBBackingStore.h:

Modules/indexeddb/server/MemoryIDBBackingStore.cpp:

(WebCore::IDBServer::MemoryIDBBackingStore::infoForObjectStore):

Modules/indexeddb/server/MemoryIDBBackingStore.h:

Teach the SQLiteIDBBackingStore to actually keep its m_databaseInfo up to date as it changes,
and to revert it when version change transactions abort:

Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction):
(WebCore::IDBServer::SQLiteIDBBackingStore::abortTransaction):
(WebCore::IDBServer::SQLiteIDBBackingStore::commitTransaction):
(WebCore::IDBServer::SQLiteIDBBackingStore::createObjectStore):
(WebCore::IDBServer::SQLiteIDBBackingStore::deleteObjectStore):
(WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
(WebCore::IDBServer::SQLiteIDBBackingStore::deleteIndex):
(WebCore::IDBServer::SQLiteIDBBackingStore::infoForObjectStore):

Modules/indexeddb/server/SQLiteIDBBackingStore.h:

Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd): Use the IDBBackingStore's copy of the

IDBObjectStoreInfo, meant only for the database thread, instead of the UniqueIDBDatabase's copy,
which is meant only for the main thread.

2:28 PM Changeset in webkit [196190] by rniwa@webkit.org

2 edits
1 add in trunk/Websites/perf.webkit.org

Perf dashboard should have a script to setup database
https://bugs.webkit.org/show_bug.cgi?id=153906

Reviewed by Chris Dumez.

Added tools/setup-database.py to setup the database. It retrieves the database name, username, password
and initializes a database at the specified location.

Install.md: Updated instruction to setup postgres to use setup-database.py.
tools/setup-database.py: Added.

(main):
(load_database_config):
(determine_psql_dir):
(start_or_stop_database):
(execute_psql_command):

1:53 PM Changeset in webkit [196189] by commit-queue@webkit.org

2 edits in trunk/Tools

Fix iOS API tests after r196082
https://bugs.webkit.org/show_bug.cgi?id=153900

Patch by Alex Christensen <achristensen@webkit.org> on 2016-02-05
Reviewed by Jer Noble.

TestWebKitAPI/Tests/WebCore/WebCoreNSURLSession.mm:

(TestWebKitAPI::WebCoreNSURLSessionTest::SetUp):
[WebView initialize] doesn't call JSC::initializeThreading on iOS.

1:41 PM Changeset in webkit [196188] by sbarati@apple.com

2 edits in trunk/Source/JavaScriptCore

follow-up to: JSC Sampling Profiler: (host) is confusing in cases where I would expect to see JS name
https://bugs.webkit.org/show_bug.cgi?id=153663
<rdar://problem/24415092>

Rubber stamped by Joseph Pecoraro.

We were performing operations that required us to
hold the VM lock even when we might not have been holding it.
We now ensure we're holding it.

inspector/agents/InspectorScriptProfilerAgent.cpp:

(Inspector::InspectorScriptProfilerAgent::trackingComplete):

1:38 PM Changeset in webkit [196187] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Navigation bar in sidebars should always fit on a single line
https://bugs.webkit.org/show_bug.cgi?id=153412
<rdar://problem/24318706>

Patch by Devin Rousso <Devin Rousso> on 2016-02-05
Reviewed by Timothy Hatcher.

This happened because the allowed maximum width of the sidebar was greater
than the minimum width derived from the currently visible sidebar.

UserInterface/Base/Utilities.js:

(Number.constrain):
Added logic to reverse the values of min and max if max is less than min.

1:34 PM Changeset in webkit [196186] by sbarati@apple.com

4 edits in trunk/Source/bmalloc

bmalloc: largeMax calculation is wrong on iOS
https://bugs.webkit.org/show_bug.cgi?id=153923

Reviewed by Mark Lam.

Our number for largeMax was larger than what we had
space to actually allocate inside the LargeChunk. This made
it so that we would allocate a large object for something
that really should be extra large. Previously:
largeMax + sizeof(LargeChunk) > 1MB
which meant that when we would grow() to accommodate an allocation
of a particular size inside a LargeObject despite the fact that
the allocation size would be too large to actually fit in the LargeObject.
This would manifest when we had an allocation size in the range:
1MB - sizeof(LargeChunk) < allocation size < largeMax

We fix this bug by being precise in our calculation of largeMax
instead of just assuming largeChunkSize * 99/100 is enough
space for the metadata.

bmalloc/LargeChunk.h:

(bmalloc::LargeChunk::get):

bmalloc/Sizes.h:

1:22 PM Changeset in webkit [196185] by timothy@apple.com

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Don't wrap labels in Breakpoint Editor popover
https://bugs.webkit.org/show_bug.cgi?id=153926
rdar://problem/24149542

Reviewed by Brian Burg.

UserInterface/Views/BreakpointPopoverController.css:

(.popover .edit-breakpoint-popover-content > table > tr > th): Added white-space: nowrap.

1:20 PM Changeset in webkit [196184] by commit-queue@webkit.org

6 edits in trunk/Source/WebInspectorUI

Web Inspector: Replace all instances of '%s' with “%s“
https://bugs.webkit.org/show_bug.cgi?id=153891
<rdar://problem/24510236>

Patch by Devin Rousso <Devin Rousso> on 2016-02-05
Reviewed by Timothy Hatcher.

Switched all WebInspector.UIString() from using to ““.

Localizations/en.lproj/localizedStrings.js:
UserInterface/Views/CSSStyleDeclarationSection.js:

(WebInspector.CSSStyleDeclarationSection.prototype._handleSelectorPaste):

UserInterface/Views/CSSStyleDeclarationTextEditor.js:

(WebInspector.CSSStyleDeclarationTextEditor.prototype._createTextMarkerForPropertyIfNeeded):

UserInterface/Views/VisualStylePropertyEditor.js:

(WebInspector.VisualStylePropertyEditor.prototype.update):

UserInterface/Views/VisualStyleSelectorTreeItem.js:

(WebInspector.VisualStyleSelectorTreeItem.prototype._updateSelectorIcon):

1:19 PM Changeset in webkit [196183] by timothy@apple.com

2 edits in trunk/Source/WebKit2

Web Inspector: Error when closing page with WebInspector open
https://bugs.webkit.org/show_bug.cgi?id=152867
rdar://problem/24099423

Reviewed by Brian Burg.

UIProcess/WebInspectorProxy.cpp:

(WebKit::WebInspectorProxy::didClose): Null out m_inspectorPage after platformDetach(),
so the views can be cleaned up correctly.

12:52 PM Changeset in webkit [196182] by bshafiei@apple.com

2 edits in tags/Safari-602.1.18.4/Source/JavaScriptCore

Merged r196144. rdar://problem/24499887

12:51 PM Changeset in webkit [196181] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.4/Source

Versioning.

12:49 PM Changeset in webkit [196180] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.4

New tag.

11:52 AM Changeset in webkit [196179] by fpizlo@apple.com

6 edits
2 adds in trunk/Source/JavaScriptCore

Arrayify for a typed array shouldn't create a monster
https://bugs.webkit.org/show_bug.cgi?id=153908
rdar://problem/24290639

Reviewed by Mark Lam.

Previously if you convinced the DFG to emit an Arrayify to ArrayStorage and then gave it a
typed array, you'd corrupt the object.

runtime/JSArrayBufferView.cpp:

(WTF::printInternal):

runtime/JSArrayBufferView.h:
runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
(JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):

runtime/JSObject.cpp:

(JSC::JSObject::copyButterfly):
(JSC::JSObject::enterDictionaryIndexingMode):
(JSC::JSObject::ensureInt32Slow):
(JSC::JSObject::ensureDoubleSlow):
(JSC::JSObject::ensureContiguousSlow):
(JSC::JSObject::ensureArrayStorageSlow):
(JSC::JSObject::growOutOfLineStorage):
(JSC::getBoundSlotBaseFunctionForGetterSetter):

runtime/Structure.h:
tests/stress/arrayify-array-storage-typed-array.js: Added. This test failed.
tests/stress/arrayify-int32-typed-array.js: Added. This test case already had other protections, but we beefed them up.

11:51 AM Changeset in webkit [196178] by achristensen@apple.com

5 edits
2 adds in trunk/Source/WebKit2

Move NetworkDataTask to its own header and source files
https://bugs.webkit.org/show_bug.cgi?id=153922

Reviewed by Tim Horton.

Also renamed NetworkSessionTaskClient to NetworkDataTaskClient.

NetworkProcess/NetworkDataTask.h: Added.

(WebKit::NetworkDataTaskClient::~NetworkDataTaskClient):
(WebKit::NetworkDataTask::create):
(WebKit::NetworkDataTask::client):
(WebKit::NetworkDataTask::pendingDownloadID):
(WebKit::NetworkDataTask::pendingDownload):
(WebKit::NetworkDataTask::setPendingDownloadID):
(WebKit::NetworkDataTask::setPendingDownload):

NetworkProcess/NetworkLoad.h:
NetworkProcess/NetworkSession.h:

(WebKit::NetworkSessionTaskClient::~NetworkSessionTaskClient): Deleted.
(WebKit::NetworkDataTask::create): Deleted.
(WebKit::NetworkDataTask::client): Deleted.
(WebKit::NetworkDataTask::pendingDownloadID): Deleted.
(WebKit::NetworkDataTask::pendingDownload): Deleted.
(WebKit::NetworkDataTask::setPendingDownloadID): Deleted.
(WebKit::NetworkDataTask::setPendingDownload): Deleted.

NetworkProcess/cocoa/NetworkDataTaskCocoa.mm: Added.

(WebKit::NetworkDataTask::NetworkDataTask):
(WebKit::NetworkDataTask::~NetworkDataTask):
(WebKit::NetworkDataTask::scheduleFailure):
(WebKit::NetworkDataTask::failureTimerFired):
(WebKit::NetworkDataTask::tryPasswordBasedAuthentication):
(WebKit::NetworkDataTask::cancel):
(WebKit::NetworkDataTask::resume):
(WebKit::NetworkDataTask::suspend):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::NetworkSession::takeDownloadID):
(WebKit::NetworkDataTask::NetworkDataTask): Deleted.
(WebKit::NetworkDataTask::~NetworkDataTask): Deleted.
(WebKit::NetworkDataTask::scheduleFailure): Deleted.
(WebKit::NetworkDataTask::failureTimerFired): Deleted.
(WebKit::NetworkDataTask::tryPasswordBasedAuthentication): Deleted.
(WebKit::NetworkDataTask::cancel): Deleted.
(WebKit::NetworkDataTask::resume): Deleted.
(WebKit::NetworkDataTask::suspend): Deleted.

WebKit2.xcodeproj/project.pbxproj:

10:52 AM Changeset in webkit [196177] by bshafiei@apple.com

3 edits in tags/Safari-602.1.18.0.2/Source/WebKit2

Merged r196037. rdar://problem/24399218

10:51 AM Changeset in webkit [196176] by bshafiei@apple.com

5 edits in tags/Safari-602.1.18.0.2/Source

Versioning.

10:49 AM Changeset in webkit [196175] by bshafiei@apple.com

1 copy in tags/Safari-602.1.18.0.2

New tag.

8:57 AM Changeset in webkit [196174] by achristensen@apple.com

20 edits in trunk/Source

Clean up Blob code
https://bugs.webkit.org/show_bug.cgi?id=153910

Reviewed by Alexey Proskuryakov.

Source/WebCore:

No new tests, no change in behavior.

css/StyleSheet.h:
fileapi/Blob.cpp:

(WebCore::Blob::Blob):
(WebCore::Blob::normalizedContentType):
(WebCore::Blob::isNormalizedContentType):
(WebCore::Blob::registry):

fileapi/Blob.h:
fileapi/BlobURL.cpp:

(WebCore::BlobURL::createPublicURL):

fileapi/BlobURL.h:

(WebCore::BlobURL::BlobURL):
(WebCore::BlobURL::blobProtocol): Deleted.

platform/PlatformStrategies.cpp:

(WebCore::setPlatformStrategies):
(WebCore::hasPlatformStrategies): Deleted.

platform/PlatformStrategies.h:
platform/network/BlobRegistry.cpp:

(WebCore::blobRegistry):

platform/network/BlobRegistry.h:
platform/network/BlobRegistryImpl.cpp:

(WebCore::BlobRegistryImpl::~BlobRegistryImpl):
(WebCore::createResourceHandle):
(WebCore::registerBlobResourceHandleConstructor):
(WebCore::BlobRegistryImpl::createResourceHandle):
(WebCore::BlobRegistryImpl::appendStorageItems):
(WebCore::BlobRegistryImpl::registerFileBlobURL):
(WebCore::BlobRegistryImpl::registerBlobURL):

platform/network/BlobRegistryImpl.h:
platform/network/BlobResourceHandle.cpp:

(WebCore::BlobResourceHandle::loadResourceSynchronously):
(WebCore::BlobResourceHandle::BlobResourceHandle):

platform/network/ResourceHandle.h:

Source/WebKit2:

NetworkProcess/FileAPI/NetworkBlobRegistry.cpp:

(WebKit::NetworkBlobRegistry::NetworkBlobRegistry):
(WebKit::NetworkBlobRegistry::registerFileBlobURL):

NetworkProcess/FileAPI/NetworkBlobRegistry.h:
NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::registerFileBlobURL):
(WebKit::NetworkConnectionToWebProcess::registerBlobURL):

WebProcess/FileAPI/BlobRegistryProxy.cpp:

(WebKit::BlobRegistryProxy::registerFileBlobURL):

WebProcess/FileAPI/BlobRegistryProxy.h:

7:38 AM Changeset in webkit [196173] by mitz@apple.com

5 edits
1 delete in trunk/Source/WebKit2

[Cocoa] Get rid of unused SPI declarations
https://bugs.webkit.org/show_bug.cgi?id=153915

Reviewed by Tim Horton.

Platform/spi/Cocoa/NSInvocationSPI.h: Removed NSInvocation SPI method declaration.

Platform/spi/ios/SafariServicesSPI.h: Removed.

UIProcess/API/Cocoa/WKSecurityOrigin.mm:

(-[WKSecurityOrigin methodSignatureForSelector:]): Deleted.
(-[WKSecurityOrigin forwardInvocation:]): Deleted.

UIProcess/ios/WKContentViewInteraction.mm: Removed unused #import.

WebKit2.xcodeproj/project.pbxproj: Removed reference to deleted header.

6:04 AM Changeset in webkit [196172] by Carlos Garcia Campos

2 edits in trunk/Source/WebCore

[GTK] Scrollbars incorrectly rendered with older versions of GTK+
https://bugs.webkit.org/show_bug.cgi?id=153861

Reviewed by Michael Catanzaro.

The theme doesn't really know it's a scrollbar. Older versions of
GTK+ require to explicitly add the scrollbar style class to the
child GtkStyleContext.

platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::createChildStyleContext):

6:02 AM WebKitGTK/2.10.x edited by Andres Gomez

(diff)

6:01 AM WebKitGTK/2.10.x edited by Andres Gomez

(diff)

5:58 AM Changeset in webkit [196171] by Carlos Garcia Campos

3 edits in trunk/Source/WebCore

[GTK] Scrollbars not correctly rendered in non GNOME environments
https://bugs.webkit.org/show_bug.cgi?id=153860

Reviewed by Michael Catanzaro.

platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::themeChangedCallback):
(WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk):

rendering/RenderThemeGtk.cpp:

(WebCore::gtkStyleChangedCallback): Deleted.

1:59 AM Changeset in webkit [196170] by youenn.fablet@crf.canon.fr

3 edits in trunk/Source/WebCore

Remove DOMWrapped parameter from JSKeyValueIterator
https://bugs.webkit.org/show_bug.cgi?id=153859

Reviewed by Sam Weinig.

No change in behavior.

Using std::declval to infer DOMWrapped from JSWrapper::wrapped.

bindings/js/JSFetchHeadersCustom.cpp:

(WebCore::JSFetchHeaders::entries):
(WebCore::JSFetchHeaders::keys):
(WebCore::JSFetchHeaders::values):

bindings/js/JSKeyValueIterator.h:

(WebCore::createIterator):
(WebCore::JSKeyValueIterator<JSWrapper>::destroy):
(WebCore::JSKeyValueIterator<JSWrapper>::next):
(WebCore::JSKeyValueIteratorPrototypeFunctionNext):
(WebCore::JSKeyValueIteratorPrototype<JSWrapper>::finishCreation):

1:03 AM Changeset in webkit [196169] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

REGRESSION (r193913): Web Inspector: Wrong z-index of inner sections
https://bugs.webkit.org/show_bug.cgi?id=153914

Reviewed by Timothy Hatcher.

UserInterface/Views/DetailsSection.css:

(.details-section .details-section > .header):

1:01 AM Changeset in webkit [196168] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Decrease font-weight of inner sections
https://bugs.webkit.org/show_bug.cgi?id=153913
<rdar://problem/24520326>

Reviewed by Timothy Hatcher.

UserInterface/Views/DetailsSection.css:

(.details-section .details-section > .header):

12:53 AM Changeset in webkit [196167] by n_wang@apple.com

3 edits
2 adds in trunk

AX: WebKit hanging when VoiceOver attempts to focus in on page
https://bugs.webkit.org/show_bug.cgi?id=153899
<rdar://problem/24506603>

Reviewed by Chris Fleizach.

Source/WebCore:

The VisiblePosition to CharacterOffset conversion will lead to an infinite loop if the
nextVisiblePostion call is returning the original VisiblePosition. Fixed it by breaking out
of the loop early in that situation.

Test: accessibility/text-marker/character-offset-visible-position-conversion-hang.html

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::characterOffsetFromVisiblePosition):

LayoutTests:

accessibility/text-marker/character-offset-visible-position-conversion-hang-expected.txt: Added.
accessibility/text-marker/character-offset-visible-position-conversion-hang.html: Added.

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed